@oneteam-app/apps-cli 0.1.0-alpha.6 → 0.1.0-alpha.7

package/dist/index.js

@@ -1,16 +1,565 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { parseArgs } from "util";
+import { parseArgs as parseArgs3 } from "util";
 
 // src/commands.ts
-import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";
-import { basename, dirname, join, relative, sep } from "path";
-import { validateManifest } from "@oneteam-app/apps/contracts";
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync, readFileSync as readFileSync4, realpathSync, writeFileSync } from "fs";
+import { basename, dirname, join as join4, relative as relative2, sep as sep2 } from "path";
+import { isHostedManifest, SECRET_NAME, validateManifest } from "@oneteam-app/apps/contracts";
+
+// src/hosted/bundle.ts
+import { execFileSync, spawnSync } from "child_process";
+import { existsSync, lstatSync, readdirSync, readFileSync } from "fs";
+import { join, relative, sep } from "path";
+import { BUNDLE_LAYOUT, MAX_BUNDLE_BYTES } from "@oneteam-app/apps/contracts";
+
+// src/hosted/scan.ts
+var ENV_FILE = /^(?:\.env|\.dev\.vars)(?:\.[^/]+)?$/;
+var ENV_EXAMPLE = /\.(?:example|sample|template|dist)$/;
+function isEnvFile(path) {
+  const name = path.split("/").pop() ?? "";
+  return ENV_FILE.test(name) && !ENV_EXAMPLE.test(name);
+}
+var KNOWN_SHAPES = [
+  { kind: "a private key", pattern: /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/g },
+  { kind: "an AWS access key", pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+  { kind: "a Stripe secret key", pattern: /\b(?:sk|rk)_live_[0-9A-Za-z]{16,}/g },
+  { kind: "a GitHub token", pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{40,})/g },
+  { kind: "a Slack token", pattern: /\bxox[abprs]-[A-Za-z0-9-]{20,}/g },
+  { kind: "a Google API key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: "an API key for an AI service", pattern: /\bsk-(?:ant|proj)-[A-Za-z0-9_-]{20,}/g },
+  { kind: "a Supabase secret key", pattern: /\bsb_secret_[A-Za-z0-9_-]{16,}/g },
+  { kind: "a Oneteam access token", pattern: /\bpat_[A-Za-z0-9]{24,}\b/g }
+];
+var JWT = /\beyJ[A-Za-z0-9_-]{8,}\.(eyJ[A-Za-z0-9_-]{8,})\.[A-Za-z0-9_-]{8,}/g;
+var ASSIGNED = /(?:secret|token|api[_-]?key|service[_-]?(?:role[_-]?)?key|private[_-]?key|password|passwd|credential)[A-Za-z0-9_]*["'`]?\s*[:=]\s*(["'`])([A-Za-z0-9+/_.=-]{24,})\1/gi;
+var PLACEHOLDER = /^(?:x+|your[_-]|example|placeholder|changeme|todo|test[_-]|fake[_-]|dummy)|\.\.\.|<|\$\{/i;
+function decodeBase64Url(value) {
+  try {
+    return Buffer.from(value.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+  } catch {
+    return "";
+  }
+}
+function looksGenerated(value) {
+  return !PLACEHOLDER.test(value) && /[0-9]/.test(value) && /[A-Za-z]/.test(value) && new Set(value).size >= 12;
+}
+function scanText(file, text, options = {}) {
+  const found = /* @__PURE__ */ new Map();
+  const lineOf = (index) => {
+    let line = 1;
+    for (let position = text.indexOf("\n"); position !== -1 && position < index; position = text.indexOf("\n", position + 1)) line += 1;
+    return line;
+  };
+  const add = (index, kind) => {
+    const line = lineOf(index);
+    if (!found.has(`${line}`)) found.set(`${line}`, { file, line, kind });
+  };
+  for (const { name, value } of options.knownValues ?? []) {
+    if (value.length < 8) continue;
+    for (let index = text.indexOf(value); index !== -1; index = text.indexOf(value, index + value.length)) {
+      add(index, `the value of ${name} from your local env file`);
+    }
+  }
+  for (const { kind, pattern } of KNOWN_SHAPES) {
+    for (const match of text.matchAll(pattern)) add(match.index, kind);
+  }
+  for (const match of text.matchAll(JWT)) {
+    if (/"role"\s*:\s*"(?:service_role|supabase_admin)"/.test(decodeBase64Url(match[1]))) add(match.index, "a Supabase service role key");
+  }
+  if (options.assignments) {
+    for (const match of text.matchAll(ASSIGNED)) {
+      if (looksGenerated(match[2])) add(match.index, "a hard-coded key or password");
+    }
+  }
+  return [...found.values()].sort((a, b) => a.line - b.line);
+}
+var TEXT_FILE = /\.(?:[cm]?[jt]sx?|json|jsonc|html?|css|svg|txt|md|map|ya?ml|toml|sql|sh|xml|webmanifest)$/i;
+var MAX_SCANNED_BYTES = 8 * 1024 * 1024;
+function isScannable(path, bytes) {
+  return bytes <= MAX_SCANNED_BYTES && (TEXT_FILE.test(path) || !/\.[^/.]+$/.test(path.split("/").pop() ?? ""));
+}
+function parseEnvFile(contents) {
+  const entries = [];
+  for (const line of contents.split(/\r?\n/)) {
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!match) continue;
+    let value = match[2].trim();
+    const quote = value[0];
+    if ((quote === '"' || quote === "'" || quote === "`") && value.endsWith(quote) && value.length >= 2) value = value.slice(1, -1);
+    else value = value.replace(/\s+#.*$/, "");
+    entries.push({ name: match[1], value });
+  }
+  return entries;
+}
+function formatFindings(findings) {
+  return findings.map((finding) => `  ${finding.file}:${finding.line}  looks like ${finding.kind}`);
+}
+
+// src/hosted/tar.ts
+import { gzipSync } from "zlib";
+var encoder = new TextEncoder();
+function field(header, offset, length, value) {
+  const bytes = encoder.encode(value);
+  if (bytes.length > length) throw new Error(`"${value}" does not fit in a tar header field of ${length} bytes`);
+  header.set(bytes, offset);
+}
+function splitPath(path) {
+  if (encoder.encode(path).length <= 100) return { name: path, prefix: "" };
+  for (let index = path.indexOf("/"); index !== -1; index = path.indexOf("/", index + 1)) {
+    const prefix = path.slice(0, index);
+    const name = path.slice(index + 1);
+    if (encoder.encode(prefix).length <= 155 && encoder.encode(name).length <= 100) return { name, prefix };
+  }
+  throw new Error(`Path is too long to pack: ${path}`);
+}
+function tarGz(entries) {
+  const sorted = [...entries].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const blocks = [];
+  for (const entry of sorted) {
+    const header = new Uint8Array(512);
+    const { name, prefix } = splitPath(entry.path);
+    field(header, 0, 100, name);
+    field(header, 100, 8, "0000644\0");
+    field(header, 108, 8, "0000000\0");
+    field(header, 116, 8, "0000000\0");
+    field(header, 124, 12, `${entry.contents.length.toString(8).padStart(11, "0")}\0`);
+    field(header, 136, 12, "00000000000\0");
+    field(header, 148, 8, "        ");
+    field(header, 156, 1, "0");
+    field(header, 257, 6, "ustar\0");
+    field(header, 263, 2, "00");
+    field(header, 345, 155, prefix);
+    const checksum = header.reduce((sum, byte) => sum + byte, 0);
+    field(header, 148, 8, `${checksum.toString(8).padStart(6, "0")}\0 `);
+    const padding = (512 - entry.contents.length % 512) % 512;
+    blocks.push(header, entry.contents, new Uint8Array(padding));
+  }
+  blocks.push(new Uint8Array(1024));
+  const tar = new Uint8Array(blocks.reduce((total, block) => total + block.length, 0));
+  let offset = 0;
+  for (const block of blocks) {
+    tar.set(block, offset);
+    offset += block.length;
+  }
+  return gzipSync(tar, { level: 9 });
+}
+
+// src/hosted/bundle.ts
+var DEFAULTS = {
+  worker: "src/worker/index.ts",
+  assets: "dist/client",
+  migrations: "migrations"
+};
+var NEVER_SOURCE = [/(^|\/)node_modules\//, /(^|\/)\.git\//, /(^|\/)\.wrangler\//, /(^|\/)\.env($|\.)/, /(^|\/)\.dev\.vars($|\.)/, /(^|\/)dist\//];
+var TEST_SOURCE = [/\.(?:test|spec)\.[^/]+$/, /(^|\/)__tests__\//, /(^|\/)vitest\.config\.[^/]+$/];
+var MAX_SOURCE_FILE_BYTES = 1024 * 1024;
+function posix(path) {
+  return path.split(sep).join("/");
+}
+function walk(directory, skip = () => false) {
+  const found = [];
+  const visit = (current) => {
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const absolute = join(current, entry.name);
+      const path = posix(relative(directory, absolute));
+      if (entry.isDirectory()) {
+        if (!skip(`${path}/`)) visit(absolute);
+      } else if (entry.isFile() && !skip(path)) {
+        found.push(path);
+      }
+    }
+  };
+  visit(directory);
+  return found.sort();
+}
+function gitFiles(root) {
+  try {
+    const output = execFileSync("git", ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
+      cwd: root,
+      stdio: ["ignore", "pipe", "ignore"],
+      maxBuffer: 64 * 1024 * 1024
+    });
+    return output.toString("utf8").split("\0").filter(Boolean);
+  } catch {
+    return null;
+  }
+}
+function sourceFiles(root) {
+  const allowed = (path) => ![...NEVER_SOURCE, ...TEST_SOURCE].some((pattern) => pattern.test(path));
+  const files = gitFiles(root) ?? walk(root, (path) => !allowed(path));
+  return files.filter(allowed).filter((path) => {
+    try {
+      const stats = lstatSync(join(root, path));
+      return stats.isFile() && stats.size <= MAX_SOURCE_FILE_BYTES;
+    } catch {
+      return false;
+    }
+  }).sort();
+}
+function localSecretValues(root) {
+  const values = [];
+  for (const name of readdirSync(root)) {
+    if (!isEnvFile(name)) continue;
+    try {
+      if (lstatSync(join(root, name)).isFile()) values.push(...parseEnvFile(readFileSync(join(root, name), "utf8")));
+    } catch {
+    }
+  }
+  return values;
+}
+function scanFile(absolute, label, options) {
+  try {
+    const stats = lstatSync(absolute);
+    if (!stats.isFile() || !isScannable(label, stats.size)) return [];
+    return scanText(label, readFileSync(absolute, "utf8"), options);
+  } catch {
+    return [];
+  }
+}
+function findSafetyProblems(root, options = {}) {
+  const knownValues = localSecretValues(root);
+  const unignoredEnvFiles = (gitFiles(root) ?? []).filter((path) => isEnvFile(path) && existsSync(join(root, path)));
+  const assetFiles = options.assetsDirectory && existsSync(options.assetsDirectory) ? walk(options.assetsDirectory) : [];
+  const assetLabel = (path) => `${posix(relative(root, options.assetsDirectory))}/${path}`;
+  const findings = [];
+  for (const path of sourceFiles(root)) findings.push(...scanFile(join(root, path), path, { assignments: true, knownValues }));
+  for (const path of assetFiles) findings.push(...scanFile(join(options.assetsDirectory, path), assetLabel(path), { knownValues }));
+  if (options.worker !== void 0) findings.push(...scanText("the bundled Worker", options.worker, { knownValues }));
+  return { unignoredEnvFiles, envFilesInAssets: assetFiles.filter(isEnvFile).map(assetLabel), findings };
+}
+function hasSafetyProblems(problems) {
+  return problems.unignoredEnvFiles.length + problems.envFilesInAssets.length + problems.findings.length > 0;
+}
+function describeSafetyProblems(problems) {
+  const lines = [];
+  if (problems.unignoredEnvFiles.length > 0) {
+    lines.push(
+      `Env files that are not git-ignored: ${problems.unignoredEnvFiles.join(", ")}`,
+      "  They hold values and would be committed with the code. Add them to .gitignore (`.dev.vars*` and `.env*`),",
+      "  and if one was committed before: remove it from git and replace the keys in it."
+    );
+  }
+  if (problems.envFilesInAssets.length > 0) {
+    lines.push(
+      `Env files in the built front end: ${problems.envFilesInAssets.join(", ")}`,
+      "  Everything there is downloaded by the browser. Remove them from the front end (e.g. from public/)."
+    );
+  }
+  if (problems.findings.length > 0) {
+    lines.push(
+      "Credentials written into the code:",
+      ...formatFindings(problems.findings),
+      '  Take the value out of the code. List its name under "secrets" in oneteam.app.json, read it in the Worker with',
+      '  secret(c.env, "NAME"), and have a person enter the value: `oneteam-apps secret set NAME --env preview` (and live),',
+      "  or the app's Secrets tab in the dashboard. A key that was in the code is no longer secret: replace it at its source."
+    );
+  }
+  return lines;
+}
+function packageManager(root) {
+  for (let directory = root; ; directory = join(directory, "..")) {
+    if (existsSync(join(directory, "pnpm-lock.yaml"))) return "pnpm";
+    if (existsSync(join(directory, "yarn.lock"))) return "yarn";
+    if (existsSync(join(directory, "bun.lock")) || existsSync(join(directory, "bun.lockb"))) return "bun";
+    if (existsSync(join(directory, "package-lock.json"))) return "npm";
+    if (join(directory, "..") === directory) return "npm";
+  }
+}
+function buildProject(root, log) {
+  const scripts = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).scripts ?? {};
+  if (!scripts.build) throw new Error('package.json has no "build" script. Add one that builds the front end (e.g. "vite build"), or pass --skip-build.');
+  const manager = packageManager(root);
+  log(`Building the front end (${manager} run build)\u2026`);
+  const result = spawnSync(manager, ["run", "build"], { cwd: root, encoding: "utf8", shell: process.platform === "win32" });
+  if (result.error) throw new Error(`Could not run "${manager} run build": ${result.error.message}`);
+  if (result.status !== 0) {
+    throw new Error(`The build failed:
+${[result.stdout, result.stderr].filter(Boolean).join("\n").trim().split("\n").slice(-40).join("\n")}`);
+  }
+}
+async function bundleWorker(root, entry) {
+  const { build } = await import("esbuild");
+  const result = await build({
+    absWorkingDir: root,
+    entryPoints: [entry],
+    bundle: true,
+    write: false,
+    format: "esm",
+    target: "es2022",
+    platform: "neutral",
+    mainFields: ["browser", "module", "main"],
+    conditions: ["workerd", "worker", "browser"],
+    // Provided by the runtime.
+    external: ["cloudflare:*", "node:*"],
+    define: { "process.env.NODE_ENV": '"production"' },
+    // Small, without comments (the review reads `source/`, and scans this file
+    // for hosts the app might call), but with real names in stack traces.
+    minifyWhitespace: true,
+    minifySyntax: true,
+    minifyIdentifiers: false,
+    legalComments: "none",
+    logLevel: "silent"
+  }).catch((error) => {
+    const details = (error.errors ?? []).map((item) => `  ${item.location ? `${item.location.file}:${item.location.line}: ` : ""}${item.text}`);
+    throw new Error(`Could not bundle the Worker (${entry}):
+${details.join("\n") || error.message}`);
+  });
+  return result.outputFiles[0].text;
+}
+async function createBundle(root, options = {}) {
+  const log = options.log ?? (() => {
+  });
+  const workerEntry = options.worker ?? DEFAULTS.worker;
+  const assetsDirectory = join(root, options.assets ?? DEFAULTS.assets);
+  const migrationsDirectory = join(root, DEFAULTS.migrations);
+  if (!existsSync(join(root, workerEntry))) {
+    throw new Error(`${workerEntry} not found. A hosted app's API lives there (see the template), or pass --worker <file>.`);
+  }
+  if (!options.skipBuild) buildProject(root, log);
+  if (!existsSync(join(assetsDirectory, "index.html"))) {
+    throw new Error(`${options.assets ?? DEFAULTS.assets}/index.html not found after the build. Pass --assets <directory> if the front end is built elsewhere.`);
+  }
+  const worker = await bundleWorker(root, workerEntry);
+  const problems = findSafetyProblems(root, { assetsDirectory, worker });
+  if (hasSafetyProblems(problems)) {
+    throw new Error(["Not uploaded: the app would carry secrets with it.", "", ...describeSafetyProblems(problems)].join("\n"));
+  }
+  const entries = [{ path: BUNDLE_LAYOUT.worker, contents: new TextEncoder().encode(worker) }];
+  const assets = walk(assetsDirectory, (path) => path.split("/").some((part) => part.startsWith(".")));
+  const migrations = existsSync(migrationsDirectory) ? readdirSync(migrationsDirectory).filter((name) => name.endsWith(".sql") && lstatSync(join(migrationsDirectory, name)).isFile()).sort() : [];
+  const source = sourceFiles(root);
+  for (const path of assets) entries.push({ path: `${BUNDLE_LAYOUT.assets}${path}`, contents: readFileSync(join(assetsDirectory, path)) });
+  for (const name of migrations) entries.push({ path: `${BUNDLE_LAYOUT.migrations}${name}`, contents: readFileSync(join(migrationsDirectory, name)) });
+  for (const path of source) entries.push({ path: `${BUNDLE_LAYOUT.source}${path}`, contents: readFileSync(join(root, path)) });
+  const archive = tarGz(entries);
+  if (archive.length > MAX_BUNDLE_BYTES) {
+    throw new Error(
+      `The bundle is ${(archive.length / 1024 / 1024).toFixed(1)} MB; the limit is ${MAX_BUNDLE_BYTES / 1024 / 1024} MB. Large files (images, video, data) usually cause this: remove them or load them from elsewhere.`
+    );
+  }
+  return { archive, files: { worker: 1, assets: assets.length, migrations: migrations.length, source: source.length } };
+}
+
+// src/hosted/job-check.ts
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+var WORKER_DIRECTORY = "src/worker";
+var SOURCE = /\.[cm]?[jt]sx?$/;
+var TEST = /\.(?:test|spec)\.[^/]+$/;
+var DEV_ENTRY = /(^|\/)dev\.[cm]?[jt]sx?$/;
+function workerSources(root) {
+  const directory = join2(root, WORKER_DIRECTORY);
+  if (!existsSync2(directory)) return [];
+  const walk3 = (current, prefix) => readdirSync2(current, { withFileTypes: true }).flatMap(
+    (entry) => entry.isDirectory() ? walk3(join2(current, entry.name), `${prefix}/${entry.name}`) : entry.isFile() && SOURCE.test(entry.name) && !TEST.test(entry.name) && !DEV_ENTRY.test(entry.name) ? [`${prefix}/${entry.name}`] : []
+  );
+  return walk3(directory, WORKER_DIRECTORY).map((file) => ({ file, source: readFileSync2(join2(root, file), "utf8") }));
+}
+function skeleton(source) {
+  const out2 = source.split("");
+  const strings = /* @__PURE__ */ new Map();
+  let index = 0;
+  const blank = (from, to) => {
+    for (let position = from; position < to; position += 1) if (out2[position] !== "\n") out2[position] = " ";
+  };
+  while (index < source.length) {
+    const char = source[index];
+    const next = source[index + 1];
+    if (char === "/" && next === "/") {
+      const end = source.indexOf("\n", index);
+      blank(index, end === -1 ? source.length : end);
+      index = end === -1 ? source.length : end;
+    } else if (char === "/" && next === "*") {
+      const end = source.indexOf("*/", index + 2);
+      blank(index, end === -1 ? source.length : end + 2);
+      index = end === -1 ? source.length : end + 2;
+    } else if (char === '"' || char === "'" || char === "`") {
+      let end = index + 1;
+      while (end < source.length && source[end] !== char) end += source[end] === "\\" ? 2 : 1;
+      strings.set(index, source.slice(index + 1, end));
+      blank(index + 1, end);
+      index = end + 1;
+    } else {
+      index += 1;
+    }
+  }
+  return { code: out2.join(""), strings };
+}
+function jobNamesIn(source) {
+  const { code, strings } = skeleton(source);
+  const call = /\bdefineJobs\s*(?:<[^>(]*>)?\s*\(/.exec(code);
+  if (!call) return null;
+  let index = call.index + call[0].length;
+  while (/\s/.test(code[index] ?? "")) index += 1;
+  if (code[index] !== "{") return { names: [], unreadable: true };
+  const names = [];
+  let unreadable = false;
+  let depth = 0;
+  let expectName = false;
+  for (; index < code.length; index += 1) {
+    const char = code[index];
+    if (char === "{" || char === "(" || char === "[") {
+      if (expectName && depth === 1 && char === "[") unreadable = true;
+      depth += 1;
+      expectName = depth === 1;
+      continue;
+    }
+    if (char === "}" || char === ")" || char === "]") {
+      depth -= 1;
+      if (depth === 0) break;
+      continue;
+    }
+    if (depth !== 1) continue;
+    if (char === ",") {
+      expectName = true;
+      continue;
+    }
+    if (!expectName || /\s/.test(char)) continue;
+    if (char === '"' || char === "'" || char === "`") {
+      names.push(strings.get(index) ?? "");
+      index += (strings.get(index) ?? "").length + 1;
+    } else if (code.startsWith("...", index)) {
+      unreadable = true;
+    } else {
+      const word = /^(?:async\s+)?\*?\s*([A-Za-z_$][\w$]*)/.exec(code.slice(index));
+      if (word) {
+        names.push(word[1]);
+        index += word[0].length - 1;
+      }
+    }
+    expectName = false;
+  }
+  return { names, unreadable };
+}
+function findJobs(root) {
+  const sources = workerSources(root);
+  const found = { names: [], file: null, unreadable: false };
+  const uses = { notify: false, sendChatMessage: false };
+  let wired = false;
+  for (const { file, source } of sources) {
+    const { code } = skeleton(source);
+    const jobs = jobNamesIn(source);
+    if (jobs) {
+      found.names.push(...jobs.names);
+      found.file ??= file;
+      found.unreadable ||= jobs.unreadable;
+    }
+    wired ||= /\bwithJobs\s*(?:<[^()]*>)?\s*\(/.test(code) || /\.handle\s*\(/.test(code);
+    uses.notify ||= /\bnotify\s*\(/.test(code) && /\bimport\b[^;]*\bnotify\b/.test(code);
+    uses.sendChatMessage ||= /\bsendChatMessage\s*\(/.test(code) && /\bimport\b[^;]*\bsendChatMessage\b/.test(code);
+  }
+  return { ...found, wired, uses };
+}
+function checkJobsAndSends(root, manifest2) {
+  const errors = [];
+  const warnings = [];
+  const found = findJobs(root);
+  const scheduled = manifest2.schedules.map((schedule) => schedule.name);
+  if (scheduled.length > 0 && found.file === null) {
+    errors.push(
+      `${MANIFEST_FILE} schedules ${scheduled.map((name) => `"${name}"`).join(", ")}, but the Worker defines no jobs. Add \`export const jobs = defineJobs({ \u2026 })\` with a handler per name (from @oneteam-app/apps/hosted) and \`export default withJobs(app, jobs)\` in src/worker/index.ts.`
+    );
+  } else if (found.unreadable) {
+    warnings.push(`${found.file}: the jobs passed to defineJobs() could not be read. List each handler by name inside defineJobs({ \u2026 }) so the schedules can be checked before a deploy.`);
+  } else {
+    for (const name of scheduled.filter((item) => !found.names.includes(item))) {
+      errors.push(`${MANIFEST_FILE} schedules "${name}", but ${found.file} has no handler of that name in defineJobs(). The job would fail every time it runs.`);
+    }
+    for (const name of found.names.filter((item) => !scheduled.includes(item))) {
+      errors.push(`${found.file} has a handler "${name}" that ${MANIFEST_FILE} does not list under "schedules": it would never run. Add { "name": "${name}", "every": \u2026 } there, or remove the handler.`);
+    }
+  }
+  if (found.file !== null && found.names.length > 0 && !found.wired) {
+    errors.push(`${found.file} defines jobs, but nothing puts them in front of the Worker. Use \`export default withJobs(app, jobs)\` in src/worker/index.ts.`);
+  }
+  for (const [used, kind, call] of [
+    [found.uses.notify, "notifications", "notify()"],
+    [found.uses.sendChatMessage, "chat_messages", "sendChatMessage()"]
+  ]) {
+    if (used && !manifest2.sends.includes(kind)) {
+      errors.push(`The Worker calls ${call}, but ${MANIFEST_FILE} does not list "${kind}" under "sends". Add it: an admin approves what an app may send, and without it every call is refused.`);
+    } else if (!used && manifest2.sends.includes(kind)) {
+      warnings.push(`${MANIFEST_FILE} lists "${kind}" under "sends", but the Worker never calls ${call}. Remove it, so an admin is not asked to approve something the app does not do.`);
+    }
+  }
+  return { errors, warnings };
+}
+
+// src/hosted/ui-check.ts
+import { existsSync as existsSync3, readdirSync as readdirSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+var CLIENT = "src/client";
+var SOURCE2 = /\.(?:[jt]sx?|css)$/;
+var TEST2 = /\.(?:test|spec)\.[^/]+$/;
+var ARBITRARY_COLOR = /-\[(?:color:|#|(?:rgba?|hsla?|oklch|oklab|lab|lch)\()[^\]]*\]/i;
+var INLINE_STYLE_COLOR = /style=\{\{[^}]*\b(?:color|background|backgroundColor|borderColor|outlineColor|fill|stroke)\s*:\s*(?!\s*["'`]var\(--)/;
+var ENTRY_STYLESHEET = "src/client/styles.css";
+var COLOR_VALUE = /#(?:[0-9a-f]{8}|[0-9a-f]{6}|[0-9a-f]{3,4})\b|\b(?:rgba?|hsla?|oklch|oklab|lab|lch)\(/i;
+var PALETTE_CLASS = /(?<![\w-])(?:bg|text|border|ring|outline|fill|stroke|from|via|to|divide|decoration|shadow|accent|caret|placeholder)-(?:(?:slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose)-\d{2,3}|white|black)(?![\w-])/;
+var RAW_ELEMENTS = [
+  [/<button[\s>]/, "a hand-made <button>: use <Button> from @oneteam-app/ui"],
+  [/<input[\s>/]/, "a hand-made <input>: use <TextInput>, <DateInput>, <Checkbox>, <Switch>, <SearchField> or <FilePicker> inside a <Field>"],
+  [/<textarea[\s>]/, "a hand-made <textarea>: use <Textarea> inside a <Field>"],
+  [/<select[\s>]/, "a hand-made <select>: use <Select> inside a <Field>"],
+  [/<dialog[\s>]|role=["']dialog["']|window\.confirm\(|(?<![\w.])confirm\(/, "a hand-made dialog: use <ConfirmDialog> or <Sheet>"]
+];
+function walk2(directory, prefix) {
+  return readdirSync3(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = `${prefix}/${entry.name}`;
+    if (entry.isDirectory()) return entry.name === "node_modules" ? [] : walk2(join3(directory, entry.name), path);
+    return entry.isFile() && SOURCE2.test(entry.name) && !TEST2.test(entry.name) ? [path] : [];
+  });
+}
+function uiWarningsIn(file, source) {
+  const warnings = [];
+  const markup = /\.[jt]sx$/.test(file);
+  let inComment = false;
+  source.split("\n").forEach((text, index) => {
+    if (inComment) {
+      inComment = !text.includes("*/");
+      return;
+    }
+    if (/^\s*\/\*/.test(text) && !text.includes("*/")) {
+      inComment = true;
+      return;
+    }
+    if (/^\s*(?:\/\/|\*|\/\*)/.test(text)) return;
+    const add = (message) => warnings.push({ file, line: index + 1, message });
+    if (ARBITRARY_COLOR.test(text)) add("a colour in an arbitrary value (bg-[#\u2026]): use the theme's names (bg-primary, text-muted-foreground, border-border\u2026)");
+    else if (markup && INLINE_STYLE_COLOR.test(text)) add("a colour in an inline style: use a Tailwind class with one of the theme's names (bg-card, text-destructive\u2026)");
+    else if (COLOR_VALUE.test(text)) add("a colour written out: use the theme (bg-card, text-muted-foreground, var(--primary)\u2026) so the organisation's colours and dark mode apply");
+    else if (PALETTE_CLASS.test(text)) add("a Tailwind palette colour: use the theme's (bg-primary, text-destructive, border-border\u2026) so the organisation's colours and dark mode apply");
+    if (markup) {
+      for (const [pattern, message] of RAW_ELEMENTS) if (pattern.test(text)) add(message);
+    }
+  });
+  return warnings;
+}
+function findUiWarnings(root) {
+  const directory = join3(root, CLIENT);
+  if (!existsSync3(directory)) return [];
+  return walk2(directory, CLIENT).flatMap((file) => [
+    // One stylesheet, the one the template starts with. Layout is Tailwind classes in the markup.
+    ...file.endsWith(".css") && file !== ENTRY_STYLESHEET ? [{ file, line: 1, message: "a stylesheet of its own: style with Tailwind classes in the markup; src/client/styles.css stays the only .css file" }] : [],
+    ...uiWarningsIn(file, readFileSync3(join3(root, file), "utf8"))
+  ]);
+}
+function usesUiPackage(root) {
+  try {
+    const pkg = JSON.parse(readFileSync3(join3(root, "package.json"), "utf8"));
+    return Boolean(pkg.dependencies?.["@oneteam-app/ui"] ?? pkg.devDependencies?.["@oneteam-app/ui"]);
+  } catch {
+    return false;
+  }
+}
 
 // src/generated/instructions.ts
-var AGENT_INSTRUCTIONS = "# Oneteam login and authorization\n\nApps built this way are opened from a Oneteam shortcut. Oneteam signs the\nemployee in (no extra password) and tells the app who they are and which\nOneteam permissions they hold. Authorization is RBAC on those permissions:\nadmins grant them through Oneteam roles, and the app checks them by name\n(`network::users.update`). Apps have no permissions or roles of their own.\n\n**Supported today**, with `@oneteam-app/apps`:\n\n- **TanStack Start** (Lovable's default, also on Cloudflare Workers): `@oneteam-app/apps/tanstack-start`\n- **Next.js App Router** (Next 15.2+, 16 recommended): `@oneteam-app/apps/next`\n\nOn any other stack, stop and tell the user it isn't supported yet.\n\n## First: the Oneteam connector\n\nRegistering the app needs the Oneteam MCP connector, which gives you the tools\n`get_app_setup_guide` and `register_app`. If you don't have them, stop and ask\nthe user to add it before anything else. In Lovable:\n\n1. Open **Connectors**, click **+** and choose **MCP server**.\n2. **Server name:** `Oneteam`. **Server URL:** `https://api.oneteam.io/mcp`\n   (a Oneteam test environment: its API URL followed by `/mcp`).\n3. Keep **OAuth**, click **Add & authorize** and sign in with Oneteam as an\n   organisation admin.\n\nThen call `get_app_setup_guide`. In Claude, Cursor and other MCP clients the\nconnector is added the same way, with the same URL.\n\nNever ask the user for Oneteam secrets before `register_app` has returned them:\nthey don't exist until the app is registered, and registering needs the app's\npublished URL.\n\n## Never hand-roll this\n\nWriting the OAuth flow by hand is the main way apps get this wrong: PKCE with\n`plain`, no `state` check, an ID token read with `atob` instead of verified,\ntokens in `localStorage`. Use the package, which does the whole flow in one\ncall, or stop and say it isn't supported on this stack.\n\n## Rules\n\nThese are not style preferences. Breaking one creates a security hole.\n\n- **Deny by default.** Next.js: `proxy.ts` runs `oneteam.proxy()` for every route.\n  TanStack Start: `src/start.ts` has a request middleware that calls\n  `oneteam.guard()`. Add to `publicPaths` only what anyone on the internet may\n  open (health checks, a public landing page), and ask the user first.\n- **Never exclude routes from the gate by file extension.** `/api/receipts/1.jpg`\n  is data. Keep the scaffolded matcher; put public files in `public/assets/`\n  and add `'/assets/*'` to `publicPaths`.\n- **The gate is a safety net, not the check.** Server actions, server functions\n  and route handlers still call `requirePermission` / `protectRoute` themselves.\n- **Check permissions on the server, every time.** Everything that reads or\n  changes protected data runs on the server (Next.js server action or route\n  handler, TanStack Start server function or server route) and calls\n  `oneteam.requirePermission(...)` (or uses `oneteam.protectRoute`). `<Protected>`\n  and `useOneteam().can` only hide UI.\n- **Never trust ids from the browser for authorization.** Load the record\n  first, then check against *its* community/owner:\n  `requirePermission('network::users.update', { communityId: expense.communityId })`.\n  Scope list queries with `oneteam.communitiesFor(session, permission)`.\n- **Identify users by `session.user.id`** (Oneteam user id) or\n  `session.user.externalId` (employee number). Not by email, not by `sub`,\n  never by a user id sent in a request body.\n- **Secrets stay on the server.** Never prefix `ONETEAM_CLIENT_SECRET` or\n  `ONETEAM_SESSION_SECRET` with `NEXT_PUBLIC_` or `VITE_`, never put them in code,\n  never log tokens or sessions, never pass `getAccessToken()` results to the browser.\n  TanStack Start: import `oneteam.server.ts` only from server functions, server\n  routes and `src/start.ts`.\n- **Don't build your own login.** No custom JWT parsing, no reading tokens from\n  query strings, no localStorage tokens, no second login screen.\n- **Authorize on Oneteam permissions only.** Not on a role, an admin flag, a\n  function name, an email domain or a hard-coded list of user ids. Pick each\n  permission from `node_modules/@oneteam-app/apps/docs/oneteam-permissions.md`\n  (online: https://unpkg.com/@oneteam-app/apps/docs/oneteam-permissions.md)\n  (typed as `OneteamPermission`, so a wrong name doesn't compile) and name the\n  ones the app uses once, e.g. in `lib/permissions.ts`. Never invent a name or\n  match on a prefix.\n- **Community permissions are not organisation-wide.** A `network:` permission\n  without `communityId` is only true for users who hold the same action\n  organisation-wide. That's intended: don't \"fix\" it by dropping the community check.\n\n## The shape of a protected app\n\nTanStack Start (Lovable): full files in [references/tanstack-start.md](references/tanstack-start.md).\n\n```ts\n// src/lib/oneteam.server.ts\nimport { createOneteam } from '@oneteam-app/apps/tanstack-start';\nimport manifest from '../../oneteam.app.json';\nexport const oneteam = createOneteam({ scopes: manifest.scopes });\n\n// src/routes/api/oneteam/$.ts\nexport const Route = createFileRoute('/api/oneteam/$')({ server: { handlers: oneteam.handlers } });\n\n// src/start.ts \u2014 deny by default\nconst oneteamMiddleware = createMiddleware().server((ctx) => oneteam.guard(ctx, { publicPaths: ['/health'] }));\nexport const startInstance = createStart(() => ({ requestMiddleware: [oneteamMiddleware] }));\n\n// any server function that touches protected data\nexport const approveExpense = createServerFn({ method: 'POST' })\n  .validator((id: string) => id)\n  .handler(async ({ data: id }) => {\n    const expense = await db.expense.findUniqueOrThrow({ where: { id } });\n    await oneteam.requirePermission(APPROVE_EXPENSES, { communityId: expense.communityId });\n    // ...\n  });\n```\n\nNext.js:\n\n```ts\n// lib/oneteam.ts\nimport { createOneteam } from '@oneteam-app/apps/next';\nimport manifest from '../oneteam.app.json';\nexport const oneteam = createOneteam({ scopes: manifest.scopes });\n\n// proxy.ts \u2014 deny by default\nexport const proxy = oneteam.proxy({ publicPaths: ['/health'] });\n\n// app/api/oneteam/[...oneteam]/route.ts\nexport const { GET, POST } = oneteam.handlers;\n\n// lib/permissions.ts \u2014 the Oneteam permissions this app checks\nexport const APPROVE_EXPENSES = 'network::users.update' satisfies OneteamPermission;\n\n// any server action or route handler that touches protected data\nconst expense = await db.expense.findUniqueOrThrow({ where: { id } });\nawait oneteam.requirePermission(APPROVE_EXPENSES, { communityId: expense.communityId });\n```\n\n## Workflow\n\nDo these in order. Don't skip the checks at the end.\n\n1. **Confirm the stack.** TanStack Start: `package.json` has `@tanstack/react-start`\n   and there is a `src/routes/` directory. Next.js: `package.json` has `next` and\n   there is an `app/` or `src/app/` directory.\n2. **Scaffold.**\n   ```bash\n   npm install @oneteam-app/apps\n   npx @oneteam-app/apps-cli init --url https://<production-domain>\n   ```\n   Ask the user for the production domain if you don't know it. Never guess one,\n   and never use a preview URL (`*.vercel.app` previews, Lovable's editor preview)\n   as the production domain; a published `https://<name>.lovable.app` is fine.\n   `init` creates the setup files of [references/tanstack-start.md](references/tanstack-start.md)\n   or [references/nextjs.md](references/nextjs.md), `oneteam.app.json` and\n   `.env.example` entries. It won't overwrite an existing `src/start.ts`,\n   `middleware.ts` or `proxy.ts`: add the gate to it yourself.\n   **Without a terminal (Lovable):** add `@oneteam-app/apps` as a dependency and\n   create those files yourself, exactly as in the reference.\n3. **Declare what the app needs** in `oneteam.app.json` `scopes`:\n   `oneteam:permissions` (scaffolded) for permission checks, `oneteam:communities`\n   for memberships and for permissions per community, `oneteam:functions` for\n   functions, `oneteam:organisation` for the employee number. Request only what\n   the app uses; admins see and approve each one. Then run\n   `npx @oneteam-app/apps-cli validate`.\n4. **Choose the permissions.** For each action not every employee may do, pick\n   the Oneteam permission whose holders should be allowed, from\n   `node_modules/@oneteam-app/apps/docs/oneteam-permissions.md`: its \"Granted by\"\n   column is the role editor toggle admins use. Use a `network:` permission when\n   the action belongs to a store/location/team, an `organisation:` one when it is\n   organisation-wide. Tell the user which permissions you chose and why.\n5. **Protect the app** following [references/tanstack-start.md](references/tanstack-start.md)\n   or [references/nextjs.md](references/nextjs.md) and the rules above.\n6. **Register the app.** With the Oneteam MCP connector, an organisation admin\n   can do it from this chat: call `register_app` with the app's production URL\n   (and its localhost URL). Otherwise an admin registers it in the Oneteam\n   dashboard. Either way the app starts in development status (only the person\n   who registered it can sign in) and comes with a client id and secret. The user\n   stores them as server-side secrets themselves (Lovable: project secrets;\n   otherwise `.env.local` and the hosting provider's secret settings), together\n   with `ONETEAM_SESSION_SECRET`, `ONETEAM_APP_URL` and, when the returned\n   `issuer` isn't `https://login.oneteam.io` (a test environment),\n   `ONETEAM_ISSUER` and `ONETEAM_API_URL` with the returned values. Never ask\n   them to paste the secret into the chat, and never repeat a secret you were shown.\n7. **Verify:** `npx @oneteam-app/apps-cli doctor`, `npm run build`, then walk\n   through [references/checklist.md](references/checklist.md) and report the\n   result to the user.\n\n## What you cannot do for the user\n\nSay these plainly instead of reporting success:\n\n- Registering the app in Oneteam and getting it approved by an admin.\n- Putting the client id and secret into `.env.local` and the hosting provider.\n- Making sure the right people hold the chosen permissions through their Oneteam roles.\n\nUntil those happen, login will fail with `access_denied` or\n`not_a_oneteam_app_client`, however correct the code is.\n\n## Reference\n\n- [references/tanstack-start.md](references/tanstack-start.md): API and patterns for the TanStack Start adapter (Lovable)\n- [references/nextjs.md](references/nextjs.md): API and patterns for the Next.js adapter\n- [references/checklist.md](references/checklist.md): final security review\n- [references/oneteam-permissions.md](references/oneteam-permissions.md): every Oneteam permission name\n- Example app: `examples/next-app` in the oneteam-apps repository\n- Local testing without Oneteam: `pnpm dev:fake` in that repository";
+var AGENT_INSTRUCTIONS = "# Oneteam login and authorization\n\nApps built this way are opened from a Oneteam shortcut. Oneteam signs the\nemployee in (no extra password) and tells the app who they are and which\nOneteam permissions they hold. Authorization is RBAC on those permissions:\nadmins grant them through Oneteam roles, and the app checks them by name\n(`network::users.update`). Apps have no permissions or roles of their own.\n\n**Supported today**, with `@oneteam-app/apps`:\n\n- **TanStack Start** (Lovable's default, also on Cloudflare Workers): `@oneteam-app/apps/tanstack-start`\n- **Next.js App Router** (Next 15.2+, 16 recommended): `@oneteam-app/apps/next`\n\nOn any other stack, stop and tell the user it isn't supported yet.\n\n**Is this the right way to build it?** For a new, small internal tool (a form,\na log, a checklist, a planner), an app that Oneteam hosts is less to run and\nsafer by default: sign-in, a database, a review of every upload, an admin's\napproval and secrets nobody can read back come with it, and there is no client\nsecret or session secret to look after. Say so, and use the `build-app`\ninstructions (`npx @oneteam-app/apps-cli init --hosted <name>`). Use the\ninstructions below when the app already exists, needs a stack or a service the\nhosted platform does not offer, or has to run on the user's own hosting: then\nhosting, the database, the secrets and their rotation are the user's to secure,\nand nobody reviews the code before colleagues use it.\n\n## First: the Oneteam connector\n\nRegistering the app needs the Oneteam MCP connector, which gives you the tools\n`get_app_setup_guide` and `register_app`. If you don't have them, stop and ask\nthe user to add it before anything else. In Lovable:\n\n1. Open **Connectors**, click **+** and choose **MCP server**.\n2. **Server name:** `Oneteam`. **Server URL:** `https://api.oneteam.io/mcp`\n   (a Oneteam test environment: its API URL followed by `/mcp`).\n3. Keep **OAuth**, click **Add & authorize** and sign in with Oneteam as an\n   organisation admin.\n\nThen call `get_app_setup_guide`. In Claude, Cursor and other MCP clients the\nconnector is added the same way, with the same URL.\n\nNever ask the user for Oneteam secrets before `register_app` has returned them:\nthey don't exist until the app is registered, and registering needs the app's\npublished URL.\n\n## Never hand-roll this\n\nWriting the OAuth flow by hand is the main way apps get this wrong: PKCE with\n`plain`, no `state` check, an ID token read with `atob` instead of verified,\ntokens in `localStorage`. Use the package, which does the whole flow in one\ncall, or stop and say it isn't supported on this stack.\n\n## Rules\n\nThese are not style preferences. Breaking one creates a security hole.\n\n- **Deny by default.** Next.js: `proxy.ts` runs `oneteam.proxy()` for every route.\n  TanStack Start: `src/start.ts` has a request middleware that calls\n  `oneteam.guard()`. Add to `publicPaths` only what anyone on the internet may\n  open (health checks, a public landing page), and ask the user first.\n- **Never exclude routes from the gate by file extension.** `/api/receipts/1.jpg`\n  is data. Keep the scaffolded matcher; put public files in `public/assets/`\n  and add `'/assets/*'` to `publicPaths`.\n- **The gate is a safety net, not the check.** Server actions, server functions\n  and route handlers still call `requirePermission` / `protectRoute` themselves.\n- **Check permissions on the server, every time.** Everything that reads or\n  changes protected data runs on the server (Next.js server action or route\n  handler, TanStack Start server function or server route) and calls\n  `oneteam.requirePermission(...)` (or uses `oneteam.protectRoute`). `<Protected>`\n  and `useOneteam().can` only hide UI.\n- **Never trust ids from the browser for authorization.** Load the record\n  first, then check against *its* community/owner:\n  `requirePermission('network::users.update', { communityId: expense.communityId })`.\n  Scope list queries with `oneteam.communitiesFor(session, permission)`.\n- **Identify users by `session.user.id`** (Oneteam user id) or\n  `session.user.externalId` (employee number). Not by email, not by `sub`,\n  never by a user id sent in a request body.\n- **Secrets stay on the server.** Never prefix `ONETEAM_CLIENT_SECRET` or\n  `ONETEAM_SESSION_SECRET` with `NEXT_PUBLIC_` or `VITE_`, never put them in code,\n  never log tokens or sessions, never pass `getAccessToken()` results to the browser.\n  TanStack Start: import `oneteam.server.ts` only from server functions, server\n  routes and `src/start.ts`.\n- **Don't build your own login.** No custom JWT parsing, no reading tokens from\n  query strings, no localStorage tokens, no second login screen.\n- **Authorize on Oneteam permissions only.** Not on a role, an admin flag, a\n  function name, an email domain or a hard-coded list of user ids. Pick each\n  permission from `node_modules/@oneteam-app/apps/docs/oneteam-permissions.md`\n  (online: https://unpkg.com/@oneteam-app/apps/docs/oneteam-permissions.md)\n  (typed as `OneteamPermission`, so a wrong name doesn't compile) and name the\n  ones the app uses once, e.g. in `lib/permissions.ts`. Never invent a name or\n  match on a prefix.\n- **Community permissions are not organisation-wide.** A `network:` permission\n  without `communityId` is only true for users who hold the same action\n  organisation-wide. That's intended: don't \"fix\" it by dropping the community check.\n\n## The shape of a protected app\n\nTanStack Start (Lovable): full files in [references/tanstack-start.md](references/tanstack-start.md).\n\n```ts\n// src/lib/oneteam.server.ts\nimport { createOneteam } from '@oneteam-app/apps/tanstack-start';\nimport manifest from '../../oneteam.app.json';\nexport const oneteam = createOneteam({ scopes: manifest.scopes });\n\n// src/routes/api/oneteam/$.ts\nexport const Route = createFileRoute('/api/oneteam/$')({ server: { handlers: oneteam.handlers } });\n\n// src/start.ts \u2014 deny by default\nconst oneteamMiddleware = createMiddleware().server((ctx) => oneteam.guard(ctx, { publicPaths: ['/health'] }));\nexport const startInstance = createStart(() => ({ requestMiddleware: [oneteamMiddleware] }));\n\n// any server function that touches protected data\nexport const approveExpense = createServerFn({ method: 'POST' })\n  .validator((id: string) => id)\n  .handler(async ({ data: id }) => {\n    const expense = await db.expense.findUniqueOrThrow({ where: { id } });\n    await oneteam.requirePermission(APPROVE_EXPENSES, { communityId: expense.communityId });\n    // ...\n  });\n```\n\nNext.js:\n\n```ts\n// lib/oneteam.ts\nimport { createOneteam } from '@oneteam-app/apps/next';\nimport manifest from '../oneteam.app.json';\nexport const oneteam = createOneteam({ scopes: manifest.scopes });\n\n// proxy.ts \u2014 deny by default\nexport const proxy = oneteam.proxy({ publicPaths: ['/health'] });\n\n// app/api/oneteam/[...oneteam]/route.ts\nexport const { GET, POST } = oneteam.handlers;\n\n// lib/permissions.ts \u2014 the Oneteam permissions this app checks\nexport const APPROVE_EXPENSES = 'network::users.update' satisfies OneteamPermission;\n\n// any server action or route handler that touches protected data\nconst expense = await db.expense.findUniqueOrThrow({ where: { id } });\nawait oneteam.requirePermission(APPROVE_EXPENSES, { communityId: expense.communityId });\n```\n\n## Workflow\n\nDo these in order. Don't skip the checks at the end.\n\n1. **Confirm the stack.** TanStack Start: `package.json` has `@tanstack/react-start`\n   and there is a `src/routes/` directory. Next.js: `package.json` has `next` and\n   there is an `app/` or `src/app/` directory.\n2. **Scaffold.**\n   ```bash\n   npm install @oneteam-app/apps\n   npx @oneteam-app/apps-cli init --url https://<production-domain>\n   ```\n   Ask the user for the production domain if you don't know it. Never guess one,\n   and never use a preview URL (`*.vercel.app` previews, Lovable's editor preview)\n   as the production domain; a published `https://<name>.lovable.app` is fine.\n   `init` creates the setup files of [references/tanstack-start.md](references/tanstack-start.md)\n   or [references/nextjs.md](references/nextjs.md), `oneteam.app.json` and\n   `.env.example` entries. It won't overwrite an existing `src/start.ts`,\n   `middleware.ts` or `proxy.ts`: add the gate to it yourself.\n   **Without a terminal (Lovable):** add `@oneteam-app/apps` as a dependency and\n   create those files yourself, exactly as in the reference.\n3. **Declare what the app needs** in `oneteam.app.json` `scopes`:\n   `oneteam:permissions` (scaffolded) for permission checks, `oneteam:communities`\n   for memberships and for permissions per community, `oneteam:functions` for\n   functions, `oneteam:organisation` for the employee number. Request only what\n   the app uses; admins see and approve each one. Then run\n   `npx @oneteam-app/apps-cli validate`.\n4. **Choose the permissions.** For each action not every employee may do, pick\n   the Oneteam permission whose holders should be allowed, from\n   `node_modules/@oneteam-app/apps/docs/oneteam-permissions.md`: its \"Granted by\"\n   column is the role editor toggle admins use. Use a `network:` permission when\n   the action belongs to a store/location/team, an `organisation:` one when it is\n   organisation-wide. Tell the user which permissions you chose and why.\n5. **Protect the app** following [references/tanstack-start.md](references/tanstack-start.md)\n   or [references/nextjs.md](references/nextjs.md) and the rules above.\n6. **Register the app.** With the Oneteam MCP connector, an organisation admin\n   can do it from this chat: call `register_app` with the app's production URL\n   (and its localhost URL). Otherwise an admin registers it in the Oneteam\n   dashboard. Either way the app starts in development status (only the person\n   who registered it can sign in) and comes with a client id and secret. The user\n   stores them as server-side secrets themselves (Lovable: project secrets;\n   otherwise `.env.local` and the hosting provider's secret settings), together\n   with `ONETEAM_SESSION_SECRET`, `ONETEAM_APP_URL` and, when the returned\n   `issuer` isn't `https://login.oneteam.io` (a test environment),\n   `ONETEAM_ISSUER` and `ONETEAM_API_URL` with the returned values. Never ask\n   them to paste the secret into the chat, and never repeat a secret you were shown.\n7. **Verify:** `npx @oneteam-app/apps-cli doctor`, `npm run build`, then walk\n   through [references/checklist.md](references/checklist.md) and report the\n   result to the user.\n8. **Offer a shortcut.** Once the app is published and login works, offer to add\n   it to Oneteam with `create_shortcut` and the `app_id` that `register_app`\n   returned. Colleagues then open it from Oneteam, on the web and in the mobile\n   app, already signed in. Ask the user which communities or functions should\n   see it; never guess the audience.\n\n## What you cannot do for the user\n\nSay these plainly instead of reporting success:\n\n- Registering the app in Oneteam and getting it approved by an admin.\n- Putting the client id and secret into `.env.local` and the hosting provider.\n- Making sure the right people hold the chosen permissions through their Oneteam roles.\n\nUntil those happen, login will fail with `access_denied` or\n`not_a_oneteam_app_client`, however correct the code is.\n\n## Reference\n\n- [references/tanstack-start.md](references/tanstack-start.md): API and patterns for the TanStack Start adapter (Lovable)\n- [references/nextjs.md](references/nextjs.md): API and patterns for the Next.js adapter\n- [references/checklist.md](references/checklist.md): final security review\n- [references/oneteam-permissions.md](references/oneteam-permissions.md): every Oneteam permission name\n- Example app: `examples/next-app` in the oneteam-apps repository\n- Local testing without Oneteam: `pnpm dev:fake` in that repository";
 var CURSOR_RULE = "---\ndescription: Oneteam login and authorization rules for this app\nalwaysApply: true\n---\n\n## First: the Oneteam connector\n\nRegistering the app needs the Oneteam MCP connector, which gives you the tools\n`get_app_setup_guide` and `register_app`. If you don't have them, stop and ask\nthe user to add it before anything else. In Lovable:\n\n1. Open **Connectors**, click **+** and choose **MCP server**.\n2. **Server name:** `Oneteam`. **Server URL:** `https://api.oneteam.io/mcp`\n   (a Oneteam test environment: its API URL followed by `/mcp`).\n3. Keep **OAuth**, click **Add & authorize** and sign in with Oneteam as an\n   organisation admin.\n\nThen call `get_app_setup_guide`. In Claude, Cursor and other MCP clients the\nconnector is added the same way, with the same URL.\n\nNever ask the user for Oneteam secrets before `register_app` has returned them:\nthey don't exist until the app is registered, and registering needs the app's\npublished URL.\n\n## Never hand-roll this\n\nWriting the OAuth flow by hand is the main way apps get this wrong: PKCE with\n`plain`, no `state` check, an ID token read with `atob` instead of verified,\ntokens in `localStorage`. Use the package, which does the whole flow in one\ncall, or stop and say it isn't supported on this stack.\n\n## Rules\n\nThese are not style preferences. Breaking one creates a security hole.\n\n- **Deny by default.** Next.js: `proxy.ts` runs `oneteam.proxy()` for every route.\n  TanStack Start: `src/start.ts` has a request middleware that calls\n  `oneteam.guard()`. Add to `publicPaths` only what anyone on the internet may\n  open (health checks, a public landing page), and ask the user first.\n- **Never exclude routes from the gate by file extension.** `/api/receipts/1.jpg`\n  is data. Keep the scaffolded matcher; put public files in `public/assets/`\n  and add `'/assets/*'` to `publicPaths`.\n- **The gate is a safety net, not the check.** Server actions, server functions\n  and route handlers still call `requirePermission` / `protectRoute` themselves.\n- **Check permissions on the server, every time.** Everything that reads or\n  changes protected data runs on the server (Next.js server action or route\n  handler, TanStack Start server function or server route) and calls\n  `oneteam.requirePermission(...)` (or uses `oneteam.protectRoute`). `<Protected>`\n  and `useOneteam().can` only hide UI.\n- **Never trust ids from the browser for authorization.** Load the record\n  first, then check against *its* community/owner:\n  `requirePermission('network::users.update', { communityId: expense.communityId })`.\n  Scope list queries with `oneteam.communitiesFor(session, permission)`.\n- **Identify users by `session.user.id`** (Oneteam user id) or\n  `session.user.externalId` (employee number). Not by email, not by `sub`,\n  never by a user id sent in a request body.\n- **Secrets stay on the server.** Never prefix `ONETEAM_CLIENT_SECRET` or\n  `ONETEAM_SESSION_SECRET` with `NEXT_PUBLIC_` or `VITE_`, never put them in code,\n  never log tokens or sessions, never pass `getAccessToken()` results to the browser.\n  TanStack Start: import `oneteam.server.ts` only from server functions, server\n  routes and `src/start.ts`.\n- **Don't build your own login.** No custom JWT parsing, no reading tokens from\n  query strings, no localStorage tokens, no second login screen.\n- **Authorize on Oneteam permissions only.** Not on a role, an admin flag, a\n  function name, an email domain or a hard-coded list of user ids. Pick each\n  permission from `node_modules/@oneteam-app/apps/docs/oneteam-permissions.md`\n  (online: https://unpkg.com/@oneteam-app/apps/docs/oneteam-permissions.md)\n  (typed as `OneteamPermission`, so a wrong name doesn't compile) and name the\n  ones the app uses once, e.g. in `lib/permissions.ts`. Never invent a name or\n  match on a prefix.\n- **Community permissions are not organisation-wide.** A `network:` permission\n  without `communityId` is only true for users who hold the same action\n  organisation-wide. That's intended: don't \"fix\" it by dropping the community check.\n\n## The shape of a protected app\n\nTanStack Start (Lovable): full files in [references/tanstack-start.md](references/tanstack-start.md).\n\n```ts\n// src/lib/oneteam.server.ts\nimport { createOneteam } from '@oneteam-app/apps/tanstack-start';\nimport manifest from '../../oneteam.app.json';\nexport const oneteam = createOneteam({ scopes: manifest.scopes });\n\n// src/routes/api/oneteam/$.ts\nexport const Route = createFileRoute('/api/oneteam/$')({ server: { handlers: oneteam.handlers } });\n\n// src/start.ts \u2014 deny by default\nconst oneteamMiddleware = createMiddleware().server((ctx) => oneteam.guard(ctx, { publicPaths: ['/health'] }));\nexport const startInstance = createStart(() => ({ requestMiddleware: [oneteamMiddleware] }));\n\n// any server function that touches protected data\nexport const approveExpense = createServerFn({ method: 'POST' })\n  .validator((id: string) => id)\n  .handler(async ({ data: id }) => {\n    const expense = await db.expense.findUniqueOrThrow({ where: { id } });\n    await oneteam.requirePermission(APPROVE_EXPENSES, { communityId: expense.communityId });\n    // ...\n  });\n```\n\nNext.js:\n\n```ts\n// lib/oneteam.ts\nimport { createOneteam } from '@oneteam-app/apps/next';\nimport manifest from '../oneteam.app.json';\nexport const oneteam = createOneteam({ scopes: manifest.scopes });\n\n// proxy.ts \u2014 deny by default\nexport const proxy = oneteam.proxy({ publicPaths: ['/health'] });\n\n// app/api/oneteam/[...oneteam]/route.ts\nexport const { GET, POST } = oneteam.handlers;\n\n// lib/permissions.ts \u2014 the Oneteam permissions this app checks\nexport const APPROVE_EXPENSES = 'network::users.update' satisfies OneteamPermission;\n\n// any server action or route handler that touches protected data\nconst expense = await db.expense.findUniqueOrThrow({ where: { id } });\nawait oneteam.requirePermission(APPROVE_EXPENSES, { communityId: expense.communityId });\n```\n";
+var HOSTED_AGENT_INSTRUCTIONS = '# Build an app that Oneteam hosts\n\nA hosted app is a small internal tool for one organisation: a web front end, an\nAPI and its own database. Oneteam runs it, signs employees in before a request\nreaches it, reviews every upload, and shows it to employees as a shortcut once\nan admin has approved it. There is no server to set up and no login to build,\nand the app holds no credentials: its database needs none, and a key for\nanother service is entered by a person, never written into the app.\n\n**What fits:** forms and logs (lost and found, incident reports, key handover),\nchecklists, request and approval flows, small planners, lookups and dashboards\non data the app itself collects, for tens to thousands of colleagues. A\nreminder, a push notification when something happens, and work that runs on a\nschedule (every 15 minutes at most) fit too: see "Scheduled jobs and sending".\n\n**What does not fit, say so instead of building around it:** file uploads and\nimage storage (not available yet), email and SMS, chat messages from the app\n(declared in the manifest already, but the platform cannot send them yet),\nwork that has to run more often than every 15 minutes or longer than 30\nseconds, real-time collaboration, reading or changing Oneteam\'s own\ndata (messages, schedules, documents), anything for people outside the\norganisation, and apps that need a server-rendered framework.\n\n## Three ways to build, and which to pick\n\nRecommend the first unless the user has a reason it cannot work. Say what the\nother two give up before going there.\n\n| | What you get | What you give up |\n|---|---|---|\n| **Hosted here** (these instructions) | Sign-in, a database, a review of every upload, an admin\'s approval, a preview next to live, secrets nobody can read back, request logs. One command to deploy | The stack is fixed (Vite + React, Hono, the app\'s own database), and what is in the "does not fit" list |\n| **Hosted elsewhere, Oneteam sign-in only** (the `oneteam-auth` instructions) | Any Next.js or TanStack Start app on the user\'s own hosting, opened from a shortcut with the employee signed in | Everything else is the user\'s to run and secure: hosting, the database and who can reach it, the client secret and session secret, backups, updates. Nobody reviews the code before colleagues use it |\n| **Code on GitHub, deployed from CI** | The same hosted app as the first row, with the code in the user\'s repository and `oneteam-apps deploy` run by a workflow | A personal access token has to live in the CI\'s secret store (`ONETEAM_TOKEN`), and whoever can change the workflow can deploy. Secrets of the app are still entered by a person, not by CI |\n\nThe third is the first with a different way of running `deploy`; nothing in\nthe app changes. Start with the first and move the deploy into CI later if the\nuser wants reviews on pull requests.\n\n## The shape of a hosted app\n\nAlways start from the template. Do not assemble this by hand and do not switch\nstack: the platform runs exactly this shape.\n\n```bash\nnpx @oneteam-app/apps-cli init --hosted "Lost and found"\ncd lost-and-found && npm install\nnpm run dev     # the app with a "View as" bar instead of sign-on; no network needed\n```\n\n| | |\n|---|---|\n| `src/worker/index.ts` | The API, with Hono, under `/api`. One Worker serves the API and the front end |\n| `src/worker/items.ts` | All database access for one kind of record |\n| `src/worker/index.test.ts` | Who can see and do what, tested with fake users |\n| `src/worker/jobs.ts` | Jobs the platform runs on a schedule (`defineJobs`). Empty to start with |\n| `src/worker/dev.ts` | Local stand-in for sign-on. Never import it, or `@oneteam-app/apps/testing`, from the API |\n| `src/client/` | The front end: Vite + React, built from the components of `@oneteam-app/ui` |\n| `migrations/NNNN_name.sql` | The database schema, applied in order. Add a new file; never edit one that was deployed |\n| `oneteam.app.json` | Name, address (`slug`), what changed (`summary`), personal data stored, who should see it, hosts it calls, the names of its secrets |\n| `.dev.vars.example` | The names of the secrets, for running locally. `.dev.vars` (the values) is git-ignored and never uploaded |\n\nThe template is a working app with one example feature (a lost and found log).\nReplace the feature, keep the structure.\n\n## Rules\n\nThese are not style preferences. The review stops a deploy that breaks them,\nand each one is a way real data leaks.\n\n- **Who is asking comes from the session, never from the request.** Every route\n  under `/api` runs after `api.use(oneteam())` and reads `c.get(\'session\')`.\n  Identify people by `session.user.id`. Never accept a user id, community id or\n  role from the body, the query string or a header as proof of anything.\n- **The database is `env.DB`, and only in the API.** No connection strings, no\n  other database, no database calls from the front end. The front end talks to\n  `/api`; `/api` talks to `env.DB`.\n- **Parameterised SQL only.** Values go in `.bind(...)`, never into the SQL\n  text: `env.DB.prepare(\'SELECT \u2026 WHERE id = ?\').bind(id)`. No template\n  literals or string concatenation with values, not for `ORDER BY`, not for\n  `IN (...)` lists (generate the `?` placeholders, bind the values), not "just\n  for numbers".\n- **Every query is limited to what this user may see.** Each table that holds\n  records has a `community_id` (and a `user_id` where records are personal),\n  and every `SELECT`, `UPDATE` and `DELETE` filters on it with values from the\n  session: the user\'s own communities (`session.user.communities`), or the\n  communities where they hold a permission (`communitiesFor(session, permission)`).\n  A query without such a filter returns other people\'s data.\n- **Every write checks a permission.** Before an `INSERT`, `UPDATE` or `DELETE`:\n  load the record with the user\'s scope, then `assertCan(session, permission,\n  { communityId: record.communityId })` for anything not every member may do.\n  A record outside the user\'s scope is `404`, not `403`. For a new record, the\n  community must be one of the user\'s own.\n- **Permissions are Oneteam permissions.** Pick each one from\n  `node_modules/@oneteam-app/apps/docs/oneteam-permissions.md`; its "Granted by"\n  column is the role editor toggle admins use. Never authorize on a role name,\n  a function name, an email address or a hard-coded list of ids, and never\n  invent a permission. `can()` in the front end only hides buttons.\n- **The app does not live at `/`.** It is served at `/<organisation>/<app>/`\n  and the same build at `/<organisation>/<app>--preview/`. Keep `base: \'./\'` in\n  `vite.config.ts` and the `<base>` tag in `index.html`; call the API with\n  `apiJson(\'/api/\u2026\')` or `api()` from `@oneteam-app/apps/hosted/react`, never\n  `fetch(\'/api/\u2026\')`; give a router `basePath()` as its base; write links and\n  asset URLs relative (`./logo.svg`), never starting with `/`.\n- **No other services by default.** The app\'s own database is enough for most\n  apps. Every host the Worker calls must be listed in `outbound_hosts` in\n  `oneteam.app.json`; ask the user before adding one.\n- **A secret is a name, never a value.** When the app needs a key for another\n  service, list its name under `secrets` in `oneteam.app.json`\n  (`{ "name": "SUPABASE_SERVICE_KEY", "host": "xyz.supabase.co" }`), add it to\n  `Env`, and read it in the Worker with `secret(c.env, \'SUPABASE_SERVICE_KEY\')`\n  from `@oneteam-app/apps/hosted`. That is all you do with it.\n  - **Never ask the person for the value**, and never accept one: if they paste\n    a key into the chat, tell them it is now exposed and should be replaced at\n    its source, and do not use it.\n  - **Never write a value** into code, a config file, `oneteam.app.json`, a\n    test, a commit message, a command line or the chat. Not a "temporary" one,\n    not base64, not split in two.\n  - **The person enters it**, once for preview and once for live: in the\n    dashboard (the app\'s Secrets tab) or with\n    `npx oneteam-apps secret set NAME --env preview`, which asks at a hidden\n    prompt. Tell them to run it themselves; do not run it for them and do not\n    pipe anything into it. After saving, nobody can read the value back.\n  - **Locally** the values are in `.dev.vars`, which the person fills in\n    themselves. Never read, print, create or edit `.dev.vars` or `.env` files;\n    `.dev.vars.example` (names only) is yours to keep up to date.\n  - **Never in the browser.** No secret in `src/client/`, no `VITE_` name for\n    one, no route that returns one. The Worker makes the call and returns the result.\n- **An outside backend (Supabase and the like) stays behind the Worker.** Use\n  it only when the app\'s own database cannot do the job, and say what that\n  gives up: the review cannot see who may read those tables. Then:\n  the service key is a secret and lives in the Worker only; the front end never\n  talks to Supabase directly and never gets a key, also not the "anon" one;\n  turn on row-level security on every table with no policy for anonymous\n  access, so a leaked URL is not a leaked database; declare the host in\n  `outbound_hosts` and as the secret\'s `host`; and keep every rule above, since\n  the Worker is still the only thing that decides who sees which row.\n- **Scheduled jobs and sending are declared, never keyed.** A reminder, a\n  notification or a recurring job needs no cron service, no API key, no\n  service account and no webhook: never create, ask for or suggest one.\n  - **Declare it** in `oneteam.app.json`:\n    `"schedules": [{ "name": "send-reminders", "every": "day", "at": "07:00" }]`\n    and `"sends": ["notifications"]`. `every` is `15_minutes`, `30_minutes`,\n    `hour` (with `minute`), `day`, `week` (with `weekdays`) or `month` (with\n    `day_of_month`, 1 to 28); `at` is `HH:MM`. Not cron syntax.\n  - **Write the handler** under the same name in `src/worker/jobs.ts`:\n    `defineJobs<Env>({ \'send-reminders\': async (job, env) => { \u2026 } })`. Every\n    schedule needs a handler and every handler a schedule; `deploy` refuses\n    otherwise.\n  - **Send with `notify(from, { userIds, title, body, path })`** from\n    `@oneteam-app/apps/hosted`, where `from` is the job (`notify(job, \u2026)`) or\n    the signed-in person\'s request (`notify(c.req.raw, \u2026)`). Title at most 80\n    characters, body at most 240, `path` a path inside the app.\n  - **Nobody is signed in during a job.** There is no session: decide who a\n    job acts for from the app\'s own data (the `user_id` stored with a record),\n    never from anything else.\n  - **An admin approves it.** A new job, one that runs more often, and\n    anything new under `sends` wait for an admin before they start; say so\n    when you hand over. The live app keeps running as it was until then.\n  - **Recipients outside the app\'s audience are skipped**, as is anyone who\n    already got five notifications from this app today (1,000 a day for the\n    whole app). `notify` returns `{ sent, skipped }`; a skip is not an error,\n    so do not retry it.\n  - **Keep a job short and safe to run twice.** It has 30 seconds. A run that\n    is missed is skipped, not caught up, and an admin can start a run by hand:\n    record what was done (a `reminded_at` column) so nobody is told twice, and\n    work through a bounded number of records per run.\n- **Say what personal data is stored.** List it in `personal_data` in plain\n  words ("name of the employee who logged an item"). Store the least that\n  works: a user id and a display name, not an email address or phone number\n  unless the feature needs it.\n\n## Design\n\n- **Build every screen from `@oneteam-app/ui`.** `Page`, `ActionBar`, `List`,\n  `ListItem`, `Card`, `Button`, `Field`, `TextInput`, `Select`, `Tabs`, `Badge`,\n  `ConfirmDialog`, `Sheet`, `toast` and the rest are listed with their props in\n  `node_modules/@oneteam-app/ui/docs/components.md`\n  ([references/ui-components.md](references/ui-components.md)): read it before\n  writing a screen. Never write your own `<button>`, `<input>`, `<select>`,\n  `<textarea>`, dialog, list row or loading state, and never call `confirm()`\n  or `alert()`: the components carry the touch sizes, focus states, labels and\n  screen-reader wiring, and they are what makes the app look like the rest.\n  If something is not there, compose it from what is, or tell the user.\n- **Style with Tailwind, and only with Tailwind.** It is set up in the template\n  and wired to the theme. Layout and spacing are Tailwind classes in the markup\n  (`flex`, `grid`, `gap-4`, `p-4`) around the components. No `.css` files of\n  your own (`src/client/styles.css` stays the two imports it starts with), no\n  inline `style` for anything a class can do.\n- **No colours of your own.** The app is wrapped once in\n  `<OneteamTheme theme={themeOf(me)}>`, which applies the organisation\'s colours\n  and logo, light and dark mode. Where a class needs a colour, use the theme\'s\n  names: `bg-card`, `bg-muted`, `text-muted-foreground`, `bg-primary`,\n  `text-destructive`, `border-border`. Never a palette colour (`bg-blue-500`,\n  `text-white`), an arbitrary one (`bg-[#123456]`), a colour in an inline\n  `style`, a hex code or `rgb(\u2026)`.\n- **Phone first, responsive by construction.** Most colleagues open the app on\n  their phone, inside the Oneteam app. Write the classes without a prefix for a\n  375 px wide screen: one column, full width. Add `sm:`, `md:` or `lg:` only to\n  let the same screen breathe on a tablet or desktop: `grid gap-6\n  md:grid-cols-2`, and `<Page width="wide">` for a screen with two columns.\n  Never a fixed pixel width, never a layout that only works wide. The component\n  reference has three layouts to copy: a list with the action at the bottom, a\n  form, and a detail screen that becomes two columns.\n- **One primary action per screen**, in an `<ActionBar>` in the `Page`\'s\n  `footer`, where a thumb reaches it. Other actions are `secondary` or `quiet`.\n  A form is its own screen, with its submit button in that bar.\n- **Plain words.** Say "store", "colleague", "returned": the words the\n  organisation uses. No product names, no jargon, no "Oneteam" in the interface.\n- **Every state has a screen:** `ListSkeleton` while loading, `EmptyState`\n  ("Nothing waiting to be picked up"), `ErrorState` with a way to try again,\n  `NotAllowedState`, a `Field`\'s `error`, and a `toast` when something worked.\n\n## Workflow\n\nDo these in order.\n\n1. **Understand what to build.** Who uses it, what do they record or look up,\n   who may do what, and per what (store, team, the whole organisation)? If it is\n   in the "does not fit" list, say so now.\n2. **Start from the template** (see above). If the folder already holds a hosted\n   app (`oneteam.app.json` with `"hosting": "hosted"`), work in it.\n3. **Model the data.** One migration per change in `migrations/`, named\n   `0002_add_reports.sql` and so on. Every table with records gets\n   `community_id TEXT NOT NULL` and an index on it. Ids from Oneteam (users,\n   communities) are stored as `TEXT`.\n4. **Build the API** in `src/worker/`, one file of queries per kind of record,\n   following the rules above. Return only the fields the front end shows.\n5. **Choose the permissions.** For each action not every member may do, pick\n   the Oneteam permission whose holders should be allowed, and name it once in\n   `src/shared.ts`. Tell the user which ones you chose and why.\n6. **Build the front end** in `src/client/` from the components of\n   `@oneteam-app/ui`, following the design rules. `npm run dev` has a "Button colour"\n   box in the bar at the top: try a pale colour and a dark one, look at the app\n   in dark mode, and at 375 px wide as well as on a full desktop window.\n7. **Write the permission tests, and run them.** In `src/worker/index.test.ts`,\n   with `withFakeContext` from `@oneteam-app/apps/testing`, for every route that\n   reads or writes records:\n   - a request without a session is refused (401);\n   - a member of another community does not see the records, and gets 404 when\n     addressing one directly;\n   - someone without the permission is refused (403), someone with it in\n     *another* community is refused too, someone with it in the record\'s\n     community succeeds.\n   ```bash\n   npm test && npm run typecheck\n   ```\n   Do not deploy with a failing or skipped test.\n8. **Fill in `oneteam.app.json`:** `name`, `description`, `summary` (what\n   changed in this version, one or two sentences an admin understands),\n   `personal_data`, `outbound_hosts`, and `secrets` (names only) when the app\n   needs any. Then `npx oneteam-apps validate` and `npx oneteam-apps doctor`:\n   the second fails when an env file is not git-ignored or a key is written\n   into the code, which `deploy` would refuse as well. It also warns about\n   colours written out and hand-made buttons, inputs and dialogs in\n   `src/client`, and about a `.css` file of your own: fix those too, by using\n   the component, a Tailwind class or the theme\'s colour name.\n9. **Ask who should see the app.** Never guess the audience. Ask the user:\n   everyone in the organisation, or certain communities or functions? Put the\n   answer in `suggested_audience.description` in their words, and the ids in\n   `network_ids` / `function_ids` when you know them (the Oneteam connector\'s\n   `get_organisation_structure` lists them). It is a suggestion: the admin who\n   approves the app decides.\n10. **Deploy.**\n    ```bash\n    npx oneteam-apps deploy\n    ```\n    The first time it needs to know who you are and which organisation the app\n    is for: `npx oneteam-apps login` (or `ONETEAM_TOKEN`), and\n    `--organisation <id>` (ask the user; the Oneteam connector\'s\n    `list_my_organisations` lists them). It builds the app, uploads it and\n    prints the review.\n11. **Read the findings and fix them.** Exit code 1 and "Deploy stopped" mean\n    nothing was deployed. Each finding is printed as\n    `SEVERITY  file:line`, what is wrong, and how to fix it. Fix the cause in\n    the source (not the symptom the review happened to notice: if one query is\n    unscoped, check the others), run the tests, deploy again. Never work around\n    a finding by hiding the code from the review. If you believe a finding is\n    wrong, tell the user and let them decide. "Not uploaded: the app would\n    carry secrets with it" means a key is in the code or an env file is not\n    ignored: take it out as the message says; the key itself has to be replaced\n    by the user where it came from.\n    When the app has jobs or sends something, the output also lists what an\n    admin has to approve before it starts. Try a job in the preview first:\n    `npx oneteam-apps job run <name> --env preview`, then\n    `npx oneteam-apps job list` for how it went. In `npm run dev`, "Run job"\n    in the bar at the top does the same, and what the app sends is printed in\n    the terminal.\n12. **Hand over.** Exit code 0 prints the preview address. Give it to the user\n    and tell them plainly what happens next: they (and testers an admin\n    invites) can open the preview now; an organisation admin has to approve the\n    version in the dashboard before colleagues see it; after that it appears as\n    a shortcut for the audience the admin chose. When the output lists\n    "Secrets that still need a value", pass that on word for word: which names,\n    for preview and for live, and that they enter them in the dashboard\'s\n    Secrets tab or with `npx oneteam-apps secret set NAME --env preview` (and\n    `--env live`). The preview does not fully work, and the version cannot be\n    approved, until they have.\n\nAfter that: `npx oneteam-apps status` shows where the app stands (which\nsecrets still need a value, which jobs run when and how the last run went), `npx oneteam-apps secret list` shows every secret\nand whether it has a value per environment (never the value), and\n`npx oneteam-apps logs` shows recent errors and requests of the running app\n(`--env preview`, `--hours 2`, `--json`). A new `deploy` creates a new version\nthat goes through review and approval again; the live version keeps running\nuntil then.\n\n## What you cannot do for the user\n\nSay these plainly instead of reporting success:\n\n- Approving the app, choosing its audience and inviting testers: an\n  organisation admin does that in the dashboard.\n- Giving people the Oneteam permissions the app checks: admins do that through\n  roles.\n- Signing in for the user. `oneteam-apps login` opens their browser; without\n  one, they create a personal access token in their Oneteam profile and set it\n  as `ONETEAM_TOKEN` themselves. Never ask them to paste a token into the chat.\n- Approving a scheduled job or what the app sends: an admin does that with the\n  version. You declare it and say what is waiting for approval.\n- Entering a secret\'s value. Only a person does that, in the dashboard\'s\n  Secrets tab or at the hidden prompt of `oneteam-apps secret set`. You declare\n  the name and say which values are still needed; you never see, ask for, type\n  or pass on a value, and there is no tool or connector that sets one for you.\n\n## Reference\n\n- `README.md` in the app: where everything lives\n- `node_modules/@oneteam-app/apps/docs/oneteam-permissions.md`\n  ([references/oneteam-permissions.md](references/oneteam-permissions.md)): every Oneteam permission name\n- Server API (`@oneteam-app/apps/hosted`): `oneteam()` (Hono middleware),\n  `getSession(request)`, `can`, `assertCan`, `communitiesFor`,\n  `toClientSession(session)` (for `GET /api/me`), `secret(env, name)` (a\n  declared secret; throws when it has no value), `errorResponse(error)` (401 /\n  403 / 503 in `app.onError`). The session has `user.id`, `user.name`,\n  `user.externalId`, `user.communities`, `user.functions`, `basePath`, `env`.\n- Jobs and sending (`@oneteam-app/apps/hosted`): `defineJobs({ name: (job, env) => \u2026 })`,\n  `withJobs(app, jobs)` as the Worker\'s default export, `notify(from, \u2026)`,\n  `sendChatMessage(from, \u2026)` (not available on the platform yet),\n  `OneteamSendError` (`code`: `not_allowed`, `not_available`, `invalid`,\n  `no_caller`, `failed`). In tests: `fakeJobRequest(name)` and `fakeSending()`\n  from `@oneteam-app/apps/testing`.\n- Front end (`@oneteam-app/apps/hosted/react`): `useMe()`, `apiJson()`, `api()`,\n  `apiUrl()`, `basePath()`, `can()`, `themeOf(me)`.\n- Components (`@oneteam-app/ui`): `node_modules/@oneteam-app/ui/docs/components.md`\n  ([references/ui-components.md](references/ui-components.md)).\n- Tests (`@oneteam-app/apps/testing`): `withFakeContext(path, user, init)`,\n  `fakeContext(user)`.';
+var HOSTED_CURSOR_RULE = '---\ndescription: Rules for this app, which Oneteam hosts\nalwaysApply: true\n---\n\n## The shape of a hosted app\n\nAlways start from the template. Do not assemble this by hand and do not switch\nstack: the platform runs exactly this shape.\n\n```bash\nnpx @oneteam-app/apps-cli init --hosted "Lost and found"\ncd lost-and-found && npm install\nnpm run dev     # the app with a "View as" bar instead of sign-on; no network needed\n```\n\n| | |\n|---|---|\n| `src/worker/index.ts` | The API, with Hono, under `/api`. One Worker serves the API and the front end |\n| `src/worker/items.ts` | All database access for one kind of record |\n| `src/worker/index.test.ts` | Who can see and do what, tested with fake users |\n| `src/worker/jobs.ts` | Jobs the platform runs on a schedule (`defineJobs`). Empty to start with |\n| `src/worker/dev.ts` | Local stand-in for sign-on. Never import it, or `@oneteam-app/apps/testing`, from the API |\n| `src/client/` | The front end: Vite + React, built from the components of `@oneteam-app/ui` |\n| `migrations/NNNN_name.sql` | The database schema, applied in order. Add a new file; never edit one that was deployed |\n| `oneteam.app.json` | Name, address (`slug`), what changed (`summary`), personal data stored, who should see it, hosts it calls, the names of its secrets |\n| `.dev.vars.example` | The names of the secrets, for running locally. `.dev.vars` (the values) is git-ignored and never uploaded |\n\nThe template is a working app with one example feature (a lost and found log).\nReplace the feature, keep the structure.\n\n## Rules\n\nThese are not style preferences. The review stops a deploy that breaks them,\nand each one is a way real data leaks.\n\n- **Who is asking comes from the session, never from the request.** Every route\n  under `/api` runs after `api.use(oneteam())` and reads `c.get(\'session\')`.\n  Identify people by `session.user.id`. Never accept a user id, community id or\n  role from the body, the query string or a header as proof of anything.\n- **The database is `env.DB`, and only in the API.** No connection strings, no\n  other database, no database calls from the front end. The front end talks to\n  `/api`; `/api` talks to `env.DB`.\n- **Parameterised SQL only.** Values go in `.bind(...)`, never into the SQL\n  text: `env.DB.prepare(\'SELECT \u2026 WHERE id = ?\').bind(id)`. No template\n  literals or string concatenation with values, not for `ORDER BY`, not for\n  `IN (...)` lists (generate the `?` placeholders, bind the values), not "just\n  for numbers".\n- **Every query is limited to what this user may see.** Each table that holds\n  records has a `community_id` (and a `user_id` where records are personal),\n  and every `SELECT`, `UPDATE` and `DELETE` filters on it with values from the\n  session: the user\'s own communities (`session.user.communities`), or the\n  communities where they hold a permission (`communitiesFor(session, permission)`).\n  A query without such a filter returns other people\'s data.\n- **Every write checks a permission.** Before an `INSERT`, `UPDATE` or `DELETE`:\n  load the record with the user\'s scope, then `assertCan(session, permission,\n  { communityId: record.communityId })` for anything not every member may do.\n  A record outside the user\'s scope is `404`, not `403`. For a new record, the\n  community must be one of the user\'s own.\n- **Permissions are Oneteam permissions.** Pick each one from\n  `node_modules/@oneteam-app/apps/docs/oneteam-permissions.md`; its "Granted by"\n  column is the role editor toggle admins use. Never authorize on a role name,\n  a function name, an email address or a hard-coded list of ids, and never\n  invent a permission. `can()` in the front end only hides buttons.\n- **The app does not live at `/`.** It is served at `/<organisation>/<app>/`\n  and the same build at `/<organisation>/<app>--preview/`. Keep `base: \'./\'` in\n  `vite.config.ts` and the `<base>` tag in `index.html`; call the API with\n  `apiJson(\'/api/\u2026\')` or `api()` from `@oneteam-app/apps/hosted/react`, never\n  `fetch(\'/api/\u2026\')`; give a router `basePath()` as its base; write links and\n  asset URLs relative (`./logo.svg`), never starting with `/`.\n- **No other services by default.** The app\'s own database is enough for most\n  apps. Every host the Worker calls must be listed in `outbound_hosts` in\n  `oneteam.app.json`; ask the user before adding one.\n- **A secret is a name, never a value.** When the app needs a key for another\n  service, list its name under `secrets` in `oneteam.app.json`\n  (`{ "name": "SUPABASE_SERVICE_KEY", "host": "xyz.supabase.co" }`), add it to\n  `Env`, and read it in the Worker with `secret(c.env, \'SUPABASE_SERVICE_KEY\')`\n  from `@oneteam-app/apps/hosted`. That is all you do with it.\n  - **Never ask the person for the value**, and never accept one: if they paste\n    a key into the chat, tell them it is now exposed and should be replaced at\n    its source, and do not use it.\n  - **Never write a value** into code, a config file, `oneteam.app.json`, a\n    test, a commit message, a command line or the chat. Not a "temporary" one,\n    not base64, not split in two.\n  - **The person enters it**, once for preview and once for live: in the\n    dashboard (the app\'s Secrets tab) or with\n    `npx oneteam-apps secret set NAME --env preview`, which asks at a hidden\n    prompt. Tell them to run it themselves; do not run it for them and do not\n    pipe anything into it. After saving, nobody can read the value back.\n  - **Locally** the values are in `.dev.vars`, which the person fills in\n    themselves. Never read, print, create or edit `.dev.vars` or `.env` files;\n    `.dev.vars.example` (names only) is yours to keep up to date.\n  - **Never in the browser.** No secret in `src/client/`, no `VITE_` name for\n    one, no route that returns one. The Worker makes the call and returns the result.\n- **An outside backend (Supabase and the like) stays behind the Worker.** Use\n  it only when the app\'s own database cannot do the job, and say what that\n  gives up: the review cannot see who may read those tables. Then:\n  the service key is a secret and lives in the Worker only; the front end never\n  talks to Supabase directly and never gets a key, also not the "anon" one;\n  turn on row-level security on every table with no policy for anonymous\n  access, so a leaked URL is not a leaked database; declare the host in\n  `outbound_hosts` and as the secret\'s `host`; and keep every rule above, since\n  the Worker is still the only thing that decides who sees which row.\n- **Scheduled jobs and sending are declared, never keyed.** A reminder, a\n  notification or a recurring job needs no cron service, no API key, no\n  service account and no webhook: never create, ask for or suggest one.\n  - **Declare it** in `oneteam.app.json`:\n    `"schedules": [{ "name": "send-reminders", "every": "day", "at": "07:00" }]`\n    and `"sends": ["notifications"]`. `every` is `15_minutes`, `30_minutes`,\n    `hour` (with `minute`), `day`, `week` (with `weekdays`) or `month` (with\n    `day_of_month`, 1 to 28); `at` is `HH:MM`. Not cron syntax.\n  - **Write the handler** under the same name in `src/worker/jobs.ts`:\n    `defineJobs<Env>({ \'send-reminders\': async (job, env) => { \u2026 } })`. Every\n    schedule needs a handler and every handler a schedule; `deploy` refuses\n    otherwise.\n  - **Send with `notify(from, { userIds, title, body, path })`** from\n    `@oneteam-app/apps/hosted`, where `from` is the job (`notify(job, \u2026)`) or\n    the signed-in person\'s request (`notify(c.req.raw, \u2026)`). Title at most 80\n    characters, body at most 240, `path` a path inside the app.\n  - **Nobody is signed in during a job.** There is no session: decide who a\n    job acts for from the app\'s own data (the `user_id` stored with a record),\n    never from anything else.\n  - **An admin approves it.** A new job, one that runs more often, and\n    anything new under `sends` wait for an admin before they start; say so\n    when you hand over. The live app keeps running as it was until then.\n  - **Recipients outside the app\'s audience are skipped**, as is anyone who\n    already got five notifications from this app today (1,000 a day for the\n    whole app). `notify` returns `{ sent, skipped }`; a skip is not an error,\n    so do not retry it.\n  - **Keep a job short and safe to run twice.** It has 30 seconds. A run that\n    is missed is skipped, not caught up, and an admin can start a run by hand:\n    record what was done (a `reminded_at` column) so nobody is told twice, and\n    work through a bounded number of records per run.\n- **Say what personal data is stored.** List it in `personal_data` in plain\n  words ("name of the employee who logged an item"). Store the least that\n  works: a user id and a display name, not an email address or phone number\n  unless the feature needs it.\n\n## Design\n\n- **Build every screen from `@oneteam-app/ui`.** `Page`, `ActionBar`, `List`,\n  `ListItem`, `Card`, `Button`, `Field`, `TextInput`, `Select`, `Tabs`, `Badge`,\n  `ConfirmDialog`, `Sheet`, `toast` and the rest are listed with their props in\n  `node_modules/@oneteam-app/ui/docs/components.md`\n  ([references/ui-components.md](references/ui-components.md)): read it before\n  writing a screen. Never write your own `<button>`, `<input>`, `<select>`,\n  `<textarea>`, dialog, list row or loading state, and never call `confirm()`\n  or `alert()`: the components carry the touch sizes, focus states, labels and\n  screen-reader wiring, and they are what makes the app look like the rest.\n  If something is not there, compose it from what is, or tell the user.\n- **Style with Tailwind, and only with Tailwind.** It is set up in the template\n  and wired to the theme. Layout and spacing are Tailwind classes in the markup\n  (`flex`, `grid`, `gap-4`, `p-4`) around the components. No `.css` files of\n  your own (`src/client/styles.css` stays the two imports it starts with), no\n  inline `style` for anything a class can do.\n- **No colours of your own.** The app is wrapped once in\n  `<OneteamTheme theme={themeOf(me)}>`, which applies the organisation\'s colours\n  and logo, light and dark mode. Where a class needs a colour, use the theme\'s\n  names: `bg-card`, `bg-muted`, `text-muted-foreground`, `bg-primary`,\n  `text-destructive`, `border-border`. Never a palette colour (`bg-blue-500`,\n  `text-white`), an arbitrary one (`bg-[#123456]`), a colour in an inline\n  `style`, a hex code or `rgb(\u2026)`.\n- **Phone first, responsive by construction.** Most colleagues open the app on\n  their phone, inside the Oneteam app. Write the classes without a prefix for a\n  375 px wide screen: one column, full width. Add `sm:`, `md:` or `lg:` only to\n  let the same screen breathe on a tablet or desktop: `grid gap-6\n  md:grid-cols-2`, and `<Page width="wide">` for a screen with two columns.\n  Never a fixed pixel width, never a layout that only works wide. The component\n  reference has three layouts to copy: a list with the action at the bottom, a\n  form, and a detail screen that becomes two columns.\n- **One primary action per screen**, in an `<ActionBar>` in the `Page`\'s\n  `footer`, where a thumb reaches it. Other actions are `secondary` or `quiet`.\n  A form is its own screen, with its submit button in that bar.\n- **Plain words.** Say "store", "colleague", "returned": the words the\n  organisation uses. No product names, no jargon, no "Oneteam" in the interface.\n- **Every state has a screen:** `ListSkeleton` while loading, `EmptyState`\n  ("Nothing waiting to be picked up"), `ErrorState` with a way to try again,\n  `NotAllowedState`, a `Field`\'s `error`, and a `toast` when something worked.\n';
 
 // src/templates.ts
 var ENV_KEYS = [
@@ -115,14 +664,14 @@ export const fetchSession = createServerFn({ method: 'GET' }).handler(() => onet
 // src/commands.ts
 var MANIFEST_FILE = "oneteam.app.json";
 function readJson(path) {
-  return JSON.parse(readFileSync(path, "utf8"));
+  return JSON.parse(readFileSync4(path, "utf8"));
 }
 function writeProjectFile(root, path, contents) {
-  const absolute = join(root, path);
+  const absolute = join4(root, path);
   const realRoot = realpathSync(root);
-  const isInside = (target) => target === realRoot || target.startsWith(`${realRoot}${sep}`);
+  const isInside = (target3) => target3 === realRoot || target3.startsWith(`${realRoot}${sep2}`);
   let existingParent = dirname(absolute);
-  while (!existsSync(existingParent)) existingParent = dirname(existingParent);
+  while (!existsSync4(existingParent)) existingParent = dirname(existingParent);
   if (!isInside(realpathSync(existingParent))) {
     throw new Error(`refusing to write ${path}: it resolves outside the project`);
   }
@@ -130,14 +679,14 @@ function writeProjectFile(root, path, contents) {
   if (!isInside(realpathSync(dirname(absolute)))) {
     throw new Error(`refusing to write ${path}: it resolves outside the project`);
   }
-  if (existsSync(absolute) && lstatSync(absolute).isSymbolicLink()) {
+  if (existsSync4(absolute) && lstatSync2(absolute).isSymbolicLink()) {
     throw new Error(`refusing to write ${path}: it is a symbolic link`);
   }
   writeFileSync(absolute, contents);
 }
 function writeIfMissing(root, path, contents, out2, force) {
-  const absolute = join(root, path);
-  if (existsSync(absolute) && !force) {
+  const absolute = join4(root, path);
+  if (existsSync4(absolute) && !force) {
     out2.warn(`skipped ${path} (already exists; use --force to overwrite)`);
     return false;
   }
@@ -146,33 +695,33 @@ function writeIfMissing(root, path, contents, out2, force) {
   return true;
 }
 function detectNextApp(root) {
-  const packagePath = join(root, "package.json");
-  if (!existsSync(packagePath)) return null;
+  const packagePath = join4(root, "package.json");
+  if (!existsSync4(packagePath)) return null;
   const pkg = readJson(packagePath);
   if (!pkg.dependencies?.next && !pkg.devDependencies?.next) return null;
-  if (existsSync(join(root, "src", "app"))) return { appDir: "src/app", srcPrefix: "src/" };
-  if (existsSync(join(root, "app"))) return { appDir: "app", srcPrefix: "" };
+  if (existsSync4(join4(root, "src", "app"))) return { appDir: "src/app", srcPrefix: "src/" };
+  if (existsSync4(join4(root, "app"))) return { appDir: "app", srcPrefix: "" };
   return null;
 }
 function hasDependency(root, name) {
-  const packagePath = join(root, "package.json");
-  if (!existsSync(packagePath)) return false;
+  const packagePath = join4(root, "package.json");
+  if (!existsSync4(packagePath)) return false;
   const pkg = readJson(packagePath);
   return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
 }
 function detectTanstackStartApp(root) {
-  return hasDependency(root, "@tanstack/react-start") && existsSync(join(root, "src", "routes"));
+  return hasDependency(root, "@tanstack/react-start") && existsSync4(join4(root, "src", "routes"));
 }
 var AGENTS_FILE = "AGENTS.md";
 var CURSOR_RULE_FILE = ".cursor/rules/oneteam-apps.mdc";
 var AGENTS_MARKER = "<!-- oneteam-apps:start -->";
 var AGENTS_END = "<!-- oneteam-apps:end -->";
-function writeAgentInstructions(root, out2, force) {
+function writeAgentSection(root, instructions, out2) {
   const section = `${AGENTS_MARKER}
-${AGENT_INSTRUCTIONS}
+${instructions}
 ${AGENTS_END}`;
-  const agentsPath = join(root, AGENTS_FILE);
-  const existing = existsSync(agentsPath) ? readFileSync(agentsPath, "utf8") : null;
+  const agentsPath = join4(root, AGENTS_FILE);
+  const existing = existsSync4(agentsPath) ? readFileSync4(agentsPath, "utf8") : null;
   const start = existing?.indexOf(AGENTS_MARKER) ?? -1;
   const end = existing && start >= 0 ? existing.indexOf(AGENTS_END, start) : -1;
   if (existing === null) {
@@ -189,6 +738,9 @@ ${section}
 `);
     out2.info(`added a Oneteam section to ${AGENTS_FILE}`);
   }
+}
+function writeAgentInstructions(root, out2, force) {
+  writeAgentSection(root, AGENT_INSTRUCTIONS, out2);
   writeIfMissing(root, CURSOR_RULE_FILE, CURSOR_RULE, out2, force);
 }
 function init(root, options, out2) {
@@ -205,16 +757,16 @@ function init(root, options, out2) {
     return 1;
   }
   writeAgentInstructions(root, out2, force);
-  if (!existsSync(join(root, MANIFEST_FILE)) || force) {
-    const name = options.name ?? readJson(join(root, "package.json")).name ?? basename(root);
+  if (!existsSync4(join4(root, MANIFEST_FILE)) || force) {
+    const name = options.name ?? readJson(join4(root, "package.json")).name ?? basename(root);
     writeIfMissing(root, MANIFEST_FILE, `${JSON.stringify(manifest(name, options.url), null, 2)}
 `, out2, force);
     if (!options.url) out2.warn(`set your production domain in ${MANIFEST_FILE} (or re-run with --url)`);
   } else {
     out2.warn(`skipped ${MANIFEST_FILE} (already exists)`);
   }
-  const envPath = join(root, ".env.example");
-  const envContents = existsSync(envPath) ? readFileSync(envPath, "utf8") : "";
+  const envPath = join4(root, ".env.example");
+  const envContents = existsSync4(envPath) ? readFileSync4(envPath, "utf8") : "";
   const missing = ENV_KEYS.filter(({ key }) => !new RegExp(`^${key}=`, "m").test(envContents));
   if (missing.length > 0) {
     const block = missing.map(({ key, comment, value }) => `# ${comment}
@@ -237,7 +789,7 @@ function initNext(root, next, out2, force) {
   writeIfMissing(root, libPath, libFile(next.srcPrefix ? "../../oneteam.app.json" : "../oneteam.app.json"), out2, force);
   writeIfMissing(root, `${next.appDir}/api/oneteam/[...oneteam]/route.ts`, routeFile(libImport), out2, force);
   const existingGate = ["proxy.ts", "middleware.ts", "src/proxy.ts", "src/middleware.ts"].find(
-    (file) => existsSync(join(root, file))
+    (file) => existsSync4(join4(root, file))
   );
   if (existingGate && !force) {
     out2.warn(
@@ -251,7 +803,7 @@ function initTanstackStart(root, out2, force) {
   writeIfMissing(root, "src/lib/oneteam.server.ts", tanstackLibFile("../../oneteam.app.json"), out2, force);
   writeIfMissing(root, "src/lib/oneteam.functions.ts", tanstackFunctionsFile(), out2, force);
   writeIfMissing(root, "src/routes/api/oneteam/$.ts", tanstackRouteFile(), out2, force);
-  if (existsSync(join(root, "src", "start.ts")) && !force) {
+  if (existsSync4(join4(root, "src", "start.ts")) && !force) {
     out2.warn(
       "found src/start.ts: not replacing it. Add a request middleware that calls oneteam.guard() so every request requires a session (see the TanStack Start example app)."
     );
@@ -260,9 +812,9 @@ function initTanstackStart(root, out2, force) {
   }
 }
 function validate(root, file, out2) {
-  const path = join(root, file ?? MANIFEST_FILE);
-  if (!existsSync(path)) {
-    out2.error(`${relative(root, path) || path} not found. Run \`oneteam-apps init\` first.`);
+  const path = join4(root, file ?? MANIFEST_FILE);
+  if (!existsSync4(path)) {
+    out2.error(`${relative2(root, path) || path} not found. Run \`oneteam-apps init\` first.`);
     return { code: 1 };
   }
   let input;
@@ -277,12 +829,14 @@ function validate(root, file, out2) {
     for (const issue of result.errors) out2.error(`${issue.path}: ${issue.message}`);
     return { code: 1 };
   }
-  out2.info(`${MANIFEST_FILE} is valid (scopes: ${result.manifest.scopes.join(" ")})`);
+  out2.info(
+    isHostedManifest(result.manifest) ? `${MANIFEST_FILE} is valid (hosted app "${result.manifest.slug}")` : `${MANIFEST_FILE} is valid (scopes: ${result.manifest.scopes.join(" ")})`
+  );
   return { code: 0, manifest: result.manifest };
 }
 function installedVersion(root, name) {
   try {
-    return readJson(join(root, "node_modules", name, "package.json")).version ?? null;
+    return readJson(join4(root, "node_modules", name, "package.json")).version ?? null;
   } catch {
     return null;
   }
@@ -297,9 +851,9 @@ function isPatchedNext(version) {
 function loadEnv(root) {
   const env = {};
   for (const file of [".env", ".env.local"]) {
-    const path = join(root, file);
-    if (!existsSync(path)) continue;
-    for (const line of readFileSync(path, "utf8").split("\n")) {
+    const path = join4(root, file);
+    if (!existsSync4(path)) continue;
+    for (const line of readFileSync4(path, "utf8").split("\n")) {
       const match = /^\s*([A-Z0-9_]+)\s*=\s*(.*)\s*$/.exec(line);
       if (match) env[match[1]] = match[2].replace(/^(['"])(.*)\1$/, "$2");
     }
@@ -313,8 +867,10 @@ async function doctor(root, options, out2) {
     out2.error(message);
   };
   const env = { ...loadEnv(root), ...options.env };
-  const { manifest: parsed } = validate(root, void 0, out2);
-  if (!parsed) failures += 1;
+  const { manifest: validated } = validate(root, void 0, out2);
+  if (!validated) failures += 1;
+  if (validated && isHostedManifest(validated)) return doctorHosted(root, validated, out2, failures);
+  const parsed = validated;
   for (const { key } of ENV_KEYS) {
     if (!env[key]) fail(`${key} is not set (.env.local)`);
   }
@@ -336,19 +892,19 @@ async function doctor(root, options, out2) {
     }
   }
   if (detectTanstackStartApp(root)) {
-    const start = join(root, "src", "start.ts");
-    if (!existsSync(start)) {
+    const start = join4(root, "src", "start.ts");
+    if (!existsSync4(start)) {
       fail("no src/start.ts: requests are not protected by default. Run `oneteam-apps init`.");
-    } else if (!readFileSync(start, "utf8").includes("oneteam.guard")) {
+    } else if (!readFileSync4(start, "utf8").includes("oneteam.guard")) {
       fail("src/start.ts does not call oneteam.guard() from a request middleware: requests are not protected by default");
     }
   } else {
     const gate = ["proxy.ts", "middleware.ts", "src/proxy.ts", "src/middleware.ts"].find(
-      (file) => existsSync(join(root, file))
+      (file) => existsSync4(join4(root, file))
     );
     if (!gate) {
       fail("no proxy.ts: routes are not protected by default. Run `oneteam-apps init`.");
-    } else if (!readFileSync(join(root, gate), "utf8").includes("oneteam.proxy")) {
+    } else if (!readFileSync4(join4(root, gate), "utf8").includes("oneteam.proxy")) {
       out2.warn(`${gate} does not call oneteam.proxy(); make sure it protects every route`);
     }
   }
@@ -372,47 +928,1380 @@ async function doctor(root, options, out2) {
   out2.info(failures === 0 ? "All checks passed" : `${failures} problem(s) found`);
   return failures === 0 ? 0 : 1;
 }
+var MAX_UI_WARNINGS = 25;
+function doctorHosted(root, manifest2, out2, failuresSoFar) {
+  let failures = failuresSoFar;
+  const fail = (message) => {
+    failures += 1;
+    out2.error(message);
+  };
+  const worker = join4(root, "src", "worker", "index.ts");
+  if (!existsSync4(worker)) {
+    fail("src/worker/index.ts not found: a hosted app's API lives there");
+  } else {
+    const source = readFileSync4(worker, "utf8");
+    if (!source.includes("@oneteam-app/apps/hosted")) fail("src/worker/index.ts does not use @oneteam-app/apps/hosted: requests are not tied to a signed-in user");
+    if (source.includes("@oneteam-app/apps/testing")) fail("src/worker/index.ts imports @oneteam-app/apps/testing: the stand-in sign-on must stay in src/worker/dev.ts");
+  }
+  if (!existsSync4(join4(root, "migrations"))) out2.warn("no migrations/ folder: the app has no database tables");
+  const jobs = checkJobsAndSends(root, manifest2);
+  for (const problem of jobs.errors) fail(problem);
+  for (const warning of jobs.warnings) out2.warn(warning);
+  const problems = findSafetyProblems(root);
+  if (hasSafetyProblems(problems)) {
+    failures += 1;
+    for (const line of describeSafetyProblems(problems)) out2.error(line);
+  }
+  const ignore = existsSync4(join4(root, ".gitignore")) ? readFileSync4(join4(root, ".gitignore"), "utf8").split(/\r?\n/).map((line) => line.trim()) : [];
+  if (!ignore.some((line) => /^\/?\.dev\.vars\*?$/.test(line))) {
+    fail(".gitignore does not list .dev.vars: local secret values would be committed. Add `.dev.vars*` and `.env*`.");
+  }
+  const declared = manifest2.secrets.map((secret) => secret.name);
+  const local = [".dev.vars", ".env", ".env.local"].flatMap(
+    (file) => existsSync4(join4(root, file)) ? parseEnvFile(readFileSync4(join4(root, file), "utf8")).map((entry) => ({ ...entry, file })) : []
+  );
+  for (const { name, file } of local) {
+    if (/^VITE_/.test(name) && (declared.includes(name.replace(/^VITE_/, "")) || /SERVICE|SECRET|PRIVATE|PASSWORD/.test(name))) {
+      fail(`${name} in ${file} would be built into the front end, where anyone can read it. Remove the VITE_ prefix and read it in the Worker.`);
+    }
+  }
+  const withoutLocalValue = declared.filter((name) => !local.some((entry) => entry.name === name && entry.value));
+  if (withoutLocalValue.length > 0) {
+    out2.warn(`no local value for ${withoutLocalValue.join(", ")}: add ${withoutLocalValue.length === 1 ? "it" : "them"} to .dev.vars yourself (never commit that file) to run the app locally`);
+  }
+  const undeclared = local.filter((entry) => entry.file === ".dev.vars" && SECRET_NAME.test(entry.name) && !declared.includes(entry.name)).map((entry) => entry.name);
+  if (undeclared.length > 0) {
+    out2.warn(`.dev.vars has ${undeclared.join(", ")}, which ${MANIFEST_FILE} does not list under "secrets": the deployed app will not have ${undeclared.length === 1 ? "it" : "them"}`);
+  }
+  if (existsSync4(join4(root, "src", "client"))) {
+    if (!usesUiPackage(root)) {
+      out2.warn("@oneteam-app/ui is not installed: the app will not look like the rest, and every button and form is yours to get right. Add it and wrap the app in <OneteamTheme>.");
+    }
+    const design = findUiWarnings(root);
+    for (const warning of design.slice(0, MAX_UI_WARNINGS)) out2.warn(`${warning.file}:${warning.line}  ${warning.message}`);
+    if (design.length > MAX_UI_WARNINGS) out2.warn(`\u2026 and ${design.length - MAX_UI_WARNINGS} more of the same kind`);
+  }
+  out2.info(failures === 0 ? "All checks passed" : `${failures} problem(s) found`);
+  return failures === 0 ? 0 : 1;
+}
+
+// src/hosted/auth.ts
+import { spawn } from "child_process";
+import { createHash, randomBytes } from "crypto";
+import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { createServer } from "http";
+import { homedir } from "os";
+import { dirname as dirname2, join as join5 } from "path";
+
+// src/hosted/api.ts
+var DEFAULT_API_URL = "https://api.oneteam.io";
+var ApiError = class extends Error {
+  constructor(status2, errorCode, message) {
+    super(message);
+    this.status = status2;
+    this.errorCode = errorCode;
+    this.name = "ApiError";
+  }
+  status;
+  errorCode;
+};
+function assertSafeApiUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`ONETEAM_API_URL is not a valid URL: ${value}`);
+  }
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new Error(`ONETEAM_API_URL must use https (http is only allowed on localhost): ${value}`);
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+function createApiClient(options) {
+  const apiUrl = assertSafeApiUrl(options.apiUrl);
+  const fetchImpl = options.fetch ?? fetch;
+  async function request(method, path, body, contentType) {
+    let response;
+    try {
+      response = await fetchImpl(`${apiUrl}${path}`, {
+        method,
+        headers: {
+          authorization: `Bearer ${options.token}`,
+          accept: "application/json",
+          ...contentType && { "content-type": contentType }
+        },
+        body
+      });
+    } catch (error) {
+      throw new Error(`Could not reach ${apiUrl}: ${error.message}`);
+    }
+    const text = await response.text();
+    let parsed = null;
+    try {
+      parsed = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    if (!response.ok) {
+      const error = parsed ?? {};
+      if (response.status === 401) {
+        throw new ApiError(401, error.error_code, "Not signed in, or the token has expired. Run `oneteam-apps login`, or set ONETEAM_TOKEN.");
+      }
+      throw new ApiError(response.status, error.error_code, error.detail ?? error.message ?? `${method} ${path} failed with ${response.status}`);
+    }
+    return parsed && typeof parsed === "object" && "data" in parsed ? parsed.data : parsed;
+  }
+  return {
+    apiUrl,
+    get: (path) => request("GET", path),
+    post: (path, body) => request("POST", path, JSON.stringify(body), "application/json"),
+    put: (path, body) => request("PUT", path, JSON.stringify(body), "application/json"),
+    delete: (path) => request("DELETE", path),
+    // fetch sets the multipart boundary itself.
+    upload: (path, form) => request("POST", path, form)
+  };
+}
+
+// src/hosted/auth.ts
+function apiUrlFrom(env, flag) {
+  return assertSafeApiUrl(flag ?? env.ONETEAM_API_URL ?? DEFAULT_API_URL);
+}
+function credentialsPath(env) {
+  return join5(env.XDG_CONFIG_HOME || join5(homedir(), ".config"), "oneteam-apps", "credentials.json");
+}
+function readAll(env) {
+  try {
+    return JSON.parse(readFileSync5(credentialsPath(env), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function readCredentials(env, apiUrl) {
+  return readAll(env)[apiUrl] ?? null;
+}
+function writeCredentials(env, apiUrl, credentials) {
+  const path = credentialsPath(env);
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  writeFileSync2(path, `${JSON.stringify({ ...readAll(env), [apiUrl]: credentials }, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+async function refresh(credentials, fetchImpl) {
+  if (!credentials.refresh_token) return null;
+  const response = await fetchImpl(credentials.token_endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: credentials.refresh_token, client_id: credentials.client_id })
+  }).catch(() => null);
+  if (!response?.ok) return null;
+  const tokens = await response.json();
+  if (!tokens.access_token) return null;
+  return {
+    ...credentials,
+    access_token: tokens.access_token,
+    refresh_token: tokens.refresh_token ?? credentials.refresh_token,
+    expires_at: Math.floor(Date.now() / 1e3) + (tokens.expires_in ?? 3600)
+  };
+}
+async function resolveToken(env, apiUrl, fetchImpl = fetch) {
+  if (env.ONETEAM_TOKEN) return env.ONETEAM_TOKEN;
+  const stored = readCredentials(env, apiUrl);
+  if (!stored) return null;
+  if (!stored.expires_at || stored.expires_at - 60 > Date.now() / 1e3) return stored.access_token;
+  const refreshed = await refresh(stored, fetchImpl);
+  if (!refreshed) return null;
+  writeCredentials(env, apiUrl, refreshed);
+  return refreshed.access_token;
+}
+function isHttpsOrLoopback(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  } catch {
+    return false;
+  }
+}
+async function getJson(url, fetchImpl) {
+  const response = await fetchImpl(url, { headers: { accept: "application/json" } }).catch(() => null);
+  if (!response?.ok) return null;
+  return await response.json().catch(() => null);
+}
+async function discover(apiUrl, fetchImpl) {
+  const resource = await getJson(
+    `${apiUrl}/.well-known/oauth-protected-resource`,
+    fetchImpl
+  );
+  const issuer = resource?.authorization_servers?.[0]?.replace(/\/+$/, "");
+  if (!issuer || !isHttpsOrLoopback(issuer)) {
+    throw new Error(`${apiUrl} does not say where to sign in (no OAuth protected-resource metadata). Set ONETEAM_TOKEN instead.`);
+  }
+  const metadata = await getJson(`${issuer}/.well-known/oauth-authorization-server`, fetchImpl) ?? await getJson(`${issuer}/.well-known/openid-configuration`, fetchImpl);
+  if (!metadata || metadata.issuer?.replace(/\/+$/, "") !== issuer) {
+    throw new Error(`Could not load the sign-in configuration of ${issuer}. Set ONETEAM_TOKEN instead.`);
+  }
+  const { authorization_endpoint: authorizationEndpoint, token_endpoint: tokenEndpoint, registration_endpoint: registrationEndpoint } = metadata;
+  if (!authorizationEndpoint || !tokenEndpoint || !registrationEndpoint) {
+    throw new Error(`${issuer} does not support signing in from a command line tool (no client registration). Set ONETEAM_TOKEN instead.`);
+  }
+  if (!metadata.code_challenge_methods_supported?.includes("S256")) {
+    throw new Error(`${issuer} does not support PKCE (S256). Set ONETEAM_TOKEN instead.`);
+  }
+  for (const endpoint of [authorizationEndpoint, tokenEndpoint, registrationEndpoint]) {
+    if (!isHttpsOrLoopback(endpoint)) throw new Error(`${issuer} lists an endpoint that is not https: ${endpoint}`);
+  }
+  return { issuer, authorizationEndpoint, tokenEndpoint, registrationEndpoint, resource: resource?.resource };
+}
+function base64Url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function openBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url]] : ["xdg-open", [url]];
+  try {
+    spawn(command, args, { stdio: "ignore", detached: true }).on("error", () => {
+    }).unref();
+  } catch {
+  }
+}
+var DONE_PAGE = `<!doctype html><meta charset="utf-8"><title>Signed in</title>
+<body style="font-family:system-ui;display:grid;place-items:center;min-height:100vh;margin:0"><p>You're signed in. You can close this tab and go back to the terminal.</p></body>`;
+async function login(options, out2) {
+  const fetchImpl = options.fetch ?? fetch;
+  const { issuer, authorizationEndpoint, tokenEndpoint, registrationEndpoint, resource } = await discover(options.apiUrl, fetchImpl);
+  const state = base64Url(randomBytes(24));
+  const verifier = base64Url(randomBytes(48));
+  const challenge = base64Url(createHash("sha256").update(verifier).digest());
+  const server = createServer();
+  await new Promise((resolve2, reject) => server.once("error", reject).listen(0, "127.0.0.1", resolve2));
+  const { port } = server.address();
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  try {
+    const registration = await fetchImpl(registrationEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        client_name: "Oneteam Apps CLI",
+        redirect_uris: [redirectUri],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none"
+      })
+    });
+    const client = await registration.json().catch(() => ({}));
+    if (!registration.ok || !client.client_id) throw new Error(`${issuer} refused to register the command line tool (${registration.status}). Set ONETEAM_TOKEN instead.`);
+    const authorize = new URL(authorizationEndpoint);
+    authorize.searchParams.set("response_type", "code");
+    authorize.searchParams.set("client_id", client.client_id);
+    authorize.searchParams.set("redirect_uri", redirectUri);
+    authorize.searchParams.set("scope", "openid profile email offline_access");
+    authorize.searchParams.set("state", state);
+    authorize.searchParams.set("code_challenge", challenge);
+    authorize.searchParams.set("code_challenge_method", "S256");
+    if (resource) authorize.searchParams.set("resource", resource);
+    const code = new Promise((resolve2, reject) => {
+      const timer = setTimeout(() => reject(new Error("Timed out waiting for the sign-in to finish")), options.timeoutMs ?? 5 * 6e4);
+      server.on("request", (request, response) => {
+        const url = new URL(request.url ?? "/", redirectUri);
+        if (url.pathname !== "/callback") {
+          response.writeHead(404).end();
+          return;
+        }
+        const failed = url.searchParams.get("error");
+        const ours = url.searchParams.get("state") === state;
+        response.writeHead(ours && !failed ? 200 : 400, { "content-type": "text/html; charset=utf-8" });
+        response.end(ours && !failed ? DONE_PAGE : "Sign-in failed. Go back to the terminal.");
+        if (!ours) return;
+        clearTimeout(timer);
+        if (failed || !url.searchParams.get("code")) reject(new Error(`Sign-in was refused: ${url.searchParams.get("error_description") ?? failed ?? "no code"}`));
+        else resolve2(url.searchParams.get("code"));
+      });
+    });
+    out2.info("Sign in with your browser:");
+    out2.info(`  ${authorize.toString()}`);
+    if (options.open) options.open(authorize.toString());
+    else if (!options.noBrowser) openBrowser(authorize.toString());
+    const tokenResponse = await fetchImpl(tokenEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code: await code,
+        redirect_uri: redirectUri,
+        client_id: client.client_id,
+        code_verifier: verifier,
+        ...resource && { resource }
+      })
+    });
+    const tokens = await tokenResponse.json().catch(() => ({}));
+    if (!tokenResponse.ok || !tokens.access_token) throw new Error(`Could not finish signing in: ${tokens.error ?? tokenResponse.status}`);
+    writeCredentials(options.env, options.apiUrl, {
+      access_token: tokens.access_token,
+      ...tokens.refresh_token && { refresh_token: tokens.refresh_token },
+      expires_at: Math.floor(Date.now() / 1e3) + (tokens.expires_in ?? 3600),
+      client_id: client.client_id,
+      token_endpoint: tokenEndpoint,
+      ...options.organisationId && { organisation_id: options.organisationId }
+    });
+    out2.info(`Signed in. Credentials saved to ${credentialsPath(options.env)}`);
+    return 0;
+  } finally {
+    server.close();
+    server.closeAllConnections?.();
+  }
+}
+function describeAuth(env, apiUrl) {
+  if (env.ONETEAM_TOKEN) return "using ONETEAM_TOKEN";
+  if (existsSync5(credentialsPath(env)) && readCredentials(env, apiUrl)) return `signed in (${credentialsPath(env)})`;
+  return "not signed in";
+}
+
+// src/hosted/deploy.ts
+import { writeFileSync as writeFileSync3 } from "fs";
+import { join as join7 } from "path";
+import {
+  HOSTED_APP_SCOPES,
+  parseAppVersion,
+  parseHostedApp
+} from "@oneteam-app/apps/contracts";
+
+// src/hosted/project.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { join as join6 } from "path";
+import { isHostedManifest as isHostedManifest2, validateManifest as validateManifest2 } from "@oneteam-app/apps/contracts";
+function readProject(root, out2) {
+  const path = join6(root, MANIFEST_FILE);
+  if (!existsSync6(path)) {
+    out2.error(`${MANIFEST_FILE} not found. Run this in the app's folder, or start one with \`oneteam-apps init --hosted <name>\`.`);
+    return null;
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync6(path, "utf8"));
+  } catch (error) {
+    out2.error(`${MANIFEST_FILE} is not valid JSON: ${error.message}`);
+    return null;
+  }
+  const result = validateManifest2(raw);
+  if (!result.success) {
+    for (const issue of result.errors) out2.error(`${MANIFEST_FILE} ${issue.path}: ${issue.message}`);
+    return null;
+  }
+  if (!isHostedManifest2(result.manifest)) {
+    out2.error(`${MANIFEST_FILE} describes an app you host yourself. Only hosted apps ("hosting": "hosted") are deployed with this command.`);
+    return null;
+  }
+  return { raw, manifest: result.manifest };
+}
+async function connect(options, out2) {
+  const apiUrl = apiUrlFrom(options.env, options.api);
+  const token = await resolveToken(options.env, apiUrl, options.fetch);
+  if (!token) {
+    out2.error("Not signed in. Run `oneteam-apps login`, or set ONETEAM_TOKEN (a personal access token from your profile).");
+    return null;
+  }
+  return createApiClient({ apiUrl, token, fetch: options.fetch });
+}
+function organisationFor(options, manifest2, apiUrl) {
+  return options.organisation ?? manifest2.organisation_id ?? options.env.ONETEAM_ORGANISATION_ID ?? readCredentials(options.env, apiUrl)?.organisation_id ?? null;
+}
+var NO_ORGANISATION = "Which organisation is this app for? Pass --organisation <id> (or set ONETEAM_ORGANISATION_ID). The id is in the address of the admin dashboard, and the Oneteam connector lists it with list_my_organisations.";
+function appPathFor(organisationId, appId) {
+  return `/v1/organisations/${encodeURIComponent(organisationId)}/apps/${encodeURIComponent(appId)}`;
+}
+
+// src/hosted/jobs.ts
+import { parseArgs } from "util";
+import {
+  JOB_NAME,
+  parseAppSchedules,
+  parseJobRun,
+  SCHEDULE_INTERVALS
+} from "@oneteam-app/apps/contracts";
+var ENVS = ["live", "preview"];
+function describeSchedule(schedule) {
+  const at = schedule.at ? ` at ${schedule.at}` : "";
+  switch (schedule.every) {
+    case "15_minutes":
+      return "every 15 minutes";
+    case "30_minutes":
+      return "every 30 minutes";
+    case "hour":
+      return schedule.minute ? `every hour at ${schedule.minute} past` : "every hour";
+    case "day":
+      return `every day${at}`;
+    case "week":
+      return `every week on ${(schedule.weekdays ?? []).join(" and ")}${at}`;
+    case "month":
+      return `every month on day ${schedule.day_of_month ?? "?"}${at}`;
+    default:
+      return String(schedule.every);
+  }
+}
+function when(iso) {
+  return iso ? `${iso.replace("T", " ").slice(0, 16)} UTC` : "";
+}
+function describeRun(run) {
+  const took = run.duration_ms === null ? "" : ` in ${run.duration_ms} ms`;
+  const by = run.manual ? ", started by hand" : "";
+  if (run.status === "succeeded") return `succeeded ${when(run.finished_at ?? run.started_at ?? run.scheduled_for)}${took}${by}`;
+  if (run.status === "failed") return `FAILED ${when(run.finished_at ?? run.started_at ?? run.scheduled_for)}${by}${run.error ? `: ${run.error}` : ""}`;
+  if (run.status === "missed") return `missed ${when(run.scheduled_for)} (not caught up)`;
+  return run.started_at ? `running since ${when(run.started_at)}${by}` : `waiting to start${by}`;
+}
+async function fetchSchedules(api, appPath, env) {
+  try {
+    return parseAppSchedules(await api.get(`${appPath}/schedules?env=${env}`));
+  } catch {
+    return null;
+  }
+}
+function describeSchedules(env, schedules) {
+  if (schedules.schedules.length === 0) return [];
+  const width = Math.max(...schedules.schedules.map((job) => job.name.length));
+  const lines = [`Scheduled jobs, ${env}${schedules.timezone ? ` (times in ${schedules.timezone})` : ""}`];
+  for (const job of schedules.schedules) {
+    lines.push(`  ${job.name.padEnd(width)}  ${describeSchedule(job)}`);
+    lines.push(
+      `  ${"".padEnd(width)}  ${env === "preview" ? "does not run by itself in preview" : job.next_run_at ? `next run ${when(job.next_run_at)}` : "not scheduled (the app is paused or not live)"}${job.last_run ? `; last run ${describeRun(job.last_run)}` : "; has not run yet"}`
+    );
+  }
+  for (const sent of schedules.sends) lines.push(`  Sent in the last 14 days: ${sent.sent} ${sent.kind.replace("_", " ")}`);
+  return lines;
+}
+function needsApproval(manifest2, live) {
+  const reasons = [];
+  const rank = (every) => SCHEDULE_INTERVALS.indexOf(every);
+  for (const schedule of manifest2.schedules) {
+    const current = live?.schedules.find((job) => job.name === schedule.name);
+    if (!current) reasons.push(`the new job "${schedule.name}" (${describeSchedule(schedule)})`);
+    else if (rank(schedule.every) < rank(current.every)) reasons.push(`"${schedule.name}" running more often (${describeSchedule(schedule)}, was ${describeSchedule(current)})`);
+    else if (schedule.every === "week" && (schedule.weekdays ?? []).some((day) => !current.weekdays.includes(day))) reasons.push(`"${schedule.name}" running on more days (${describeSchedule(schedule)})`);
+  }
+  for (const kind of manifest2.sends) {
+    if (!live?.sends.some((sent) => sent.kind === kind)) reasons.push(`sending ${kind.replace("_", " ")}`);
+  }
+  return reasons;
+}
+async function target(root, options, out2) {
+  const project = readProject(root, out2);
+  if (!project) return null;
+  if (!project.manifest.id) {
+    out2.error("This app has not been deployed yet. Run `oneteam-apps deploy` first.");
+    return null;
+  }
+  const api = await connect(options, out2);
+  if (!api) return null;
+  const organisationId = organisationFor(options, project.manifest, api.apiUrl);
+  if (!organisationId) {
+    out2.error(NO_ORGANISATION);
+    return null;
+  }
+  return { manifest: project.manifest, api, appPath: appPathFor(organisationId, project.manifest.id) };
+}
+async function jobList(root, options, out2) {
+  const print = options.print ?? ((text) => console.log(text));
+  if (options.appEnv !== void 0 && options.appEnv !== "live" && options.appEnv !== "preview") {
+    out2.error('--env must be "live" or "preview"');
+    return 1;
+  }
+  const found = await target(root, options, out2);
+  if (!found) return 1;
+  const envs = options.appEnv ? [options.appEnv] : ENVS;
+  const results = await Promise.all(envs.map((env) => fetchSchedules(found.api, found.appPath, env)));
+  if (results.some((result) => !result)) {
+    out2.error("The API did not return the schedules.");
+    return 1;
+  }
+  if (options.json) {
+    print(JSON.stringify(Object.fromEntries(envs.map((env, index) => [env, results[index]])), null, 2));
+    return 0;
+  }
+  let any = false;
+  envs.forEach((env, index) => {
+    const lines = describeSchedules(env, results[index]);
+    if (lines.length === 0) return;
+    if (any) out2.info("");
+    any = true;
+    for (const line of lines) out2.info(line);
+  });
+  if (!any) {
+    const local = found.manifest.schedules.map((schedule) => schedule.name);
+    out2.info(
+      local.length > 0 ? `No scheduled jobs deployed yet. ${MANIFEST_FILE} lists ${local.join(", ")}: run \`oneteam-apps deploy\`.` : `This app has no scheduled jobs. Add them under "schedules" in ${MANIFEST_FILE}.`
+    );
+  }
+  return 0;
+}
+async function jobRun(root, name, options, out2) {
+  const print = options.print ?? ((text) => console.log(text));
+  if (!name) {
+    out2.error("Which job? oneteam-apps job run NAME --env live|preview");
+    return 1;
+  }
+  if (!JOB_NAME.test(name)) {
+    out2.error("A job's name is lowercase letters, digits and hyphens, e.g. send-reminders.");
+    return 1;
+  }
+  if (options.appEnv !== "live" && options.appEnv !== "preview") {
+    out2.error(
+      options.appEnv === void 0 ? "Say where: --env preview runs the version waiting for approval, --env live the one colleagues use. A job run by hand does what it does on its schedule, sending included." : '--env must be "live" or "preview"'
+    );
+    return 1;
+  }
+  const found = await target(root, options, out2);
+  if (!found) return 1;
+  try {
+    const run = parseJobRun(await found.api.post(`${found.appPath}/schedules/${encodeURIComponent(name)}/run?env=${options.appEnv}`, {}));
+    if (options.json) {
+      print(JSON.stringify({ requested: true, name, env: options.appEnv, run }, null, 2));
+      return 0;
+    }
+    out2.info(`Asked for a run of ${name} in ${options.appEnv}. It starts within a minute; \`oneteam-apps job list --env ${options.appEnv}\` shows how it went.`);
+    return 0;
+  } catch (error) {
+    out2.error(`Could not run ${name}: ${error.message}`);
+    return 1;
+  }
+}
+var USAGE = "Usage: oneteam-apps job list [--env live|preview]  |  oneteam-apps job run NAME --env live|preview";
+async function jobCommand(root, args, base, out2, quiet2 = out2) {
+  const [action, ...rest] = args;
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: rest,
+      allowPositionals: true,
+      options: { api: { type: "string" }, organisation: { type: "string" }, json: { type: "boolean" }, env: { type: "string" } }
+    });
+  } catch (error) {
+    out2.error(`${error.message}. ${USAGE}`);
+    return 1;
+  }
+  const { values, positionals } = parsed;
+  const options = { ...base, api: values.api, organisation: values.organisation, json: values.json, appEnv: values.env };
+  const output = values.json ? quiet2 : out2;
+  if (action === void 0 || action === "list") return positionals.length > 0 ? (out2.error(USAGE), 1) : jobList(root, options, output);
+  if (action === "run") return positionals.length > 1 ? (out2.error("One job at a time: oneteam-apps job run NAME --env live|preview"), 1) : jobRun(root, positionals[0], options, output);
+  out2.error(USAGE);
+  return 1;
+}
+
+// src/hosted/secrets.ts
+import { parseArgs as parseArgs2 } from "util";
+import { isReservedSecretName, parseAppSecrets, SECRET_NAME as SECRET_NAME2 } from "@oneteam-app/apps/contracts";
+var ENVS2 = ["preview", "live"];
+function readSecretValue(prompt, input) {
+  const { stdin, stderr } = input;
+  stdin.setEncoding("utf8");
+  if (!stdin.isTTY || !stdin.setRawMode) {
+    return new Promise((resolve2, reject) => {
+      let value = "";
+      stdin.on("data", ((chunk) => void (value += chunk)));
+      stdin.on("end", (() => resolve2(value.replace(/\r?\n$/, ""))));
+      stdin.on("error", ((error) => reject(error)));
+      stdin.resume();
+    });
+  }
+  return new Promise((resolve2, reject) => {
+    let value = "";
+    const finish = (error) => {
+      stdin.removeListener("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+      stderr.write("\n");
+      if (error) reject(error);
+      else resolve2(value);
+    };
+    const onData = (chunk) => {
+      for (const char of chunk) {
+        if (char === "\r" || char === "\n" || char === "") return finish();
+        if (char === "") return finish(new Error("Cancelled. Nothing was saved."));
+        if (char === "\x7F" || char === "\b") value = value.slice(0, -1);
+        else if (char >= " ") value += char;
+      }
+    };
+    stderr.write(prompt);
+    stdin.setRawMode(true);
+    stdin.on("data", onData);
+    stdin.resume();
+  });
+}
+async function target2(root, options, out2) {
+  const project = readProject(root, out2);
+  if (!project) return null;
+  if (!project.manifest.id) {
+    out2.error("This app has not been deployed yet. Run `oneteam-apps deploy` first: secrets belong to a registered app.");
+    return null;
+  }
+  const api = await connect(options, out2);
+  if (!api) return null;
+  const organisationId = organisationFor(options, project.manifest, api.apiUrl);
+  if (!organisationId) {
+    out2.error(NO_ORGANISATION);
+    return null;
+  }
+  return { project, api, appPath: appPathFor(organisationId, project.manifest.id) };
+}
+function envOption(value) {
+  if (value === void 0) return void 0;
+  return value === "live" || value === "preview" ? value : null;
+}
+function nameProblem(name, command) {
+  if (!name) return `Which secret? oneteam-apps secret ${command} NAME --env live|preview`;
+  if (!SECRET_NAME2.test(name)) return "A secret's name is capitals, digits and underscores, starting with a letter, e.g. SUPABASE_SERVICE_KEY.";
+  if (isReservedSecretName(name)) return `${name} is reserved for the platform. Pick another name.`;
+  return null;
+}
+var ENV_REQUIRED = "Say which environment: --env preview or --env live. Each has its own value and they are entered separately, so that a test key never ends up live by accident.";
+async function fetchSecrets(api, appPath, env) {
+  return parseAppSecrets(await api.get(`${appPath}/secrets?env=${env}`));
+}
+async function missingSecrets(api, appPath) {
+  try {
+    const [preview, live] = await Promise.all(ENVS2.map((env) => fetchSecrets(api, appPath, env)));
+    if (!preview || !live) return null;
+    const names = (secrets) => secrets.secrets.filter((secret) => secret.status === "missing").map((secret) => secret.name);
+    return { preview: names(preview), live: names(live) };
+  } catch {
+    return null;
+  }
+}
+function describeMissingSecrets(missing) {
+  if (missing.preview.length + missing.live.length === 0) return [];
+  const lines = ["", "Secrets that still need a value"];
+  for (const env of ENVS2) {
+    if (missing[env].length > 0) lines.push(`  ${`${env}:`.padEnd(9)}${missing[env].join(", ")}`);
+  }
+  const first = missing.preview[0] ?? missing.live[0];
+  const firstEnv = missing.preview.length > 0 ? "preview" : "live";
+  lines.push(
+    "  A person enters each value once, per environment: in the dashboard (the app's Secrets tab), or in a terminal with",
+    `    oneteam-apps secret set ${first} --env ${firstEnv}`,
+    "  The value is typed at a hidden prompt. Never put it in the code, in oneteam.app.json or in a chat.",
+    missing.live.length > 0 ? "  The app cannot be approved or go live until the live values are there." : "  The preview does not work fully until these are there."
+  );
+  return lines;
+}
+function describeSecret(secret, width) {
+  const when2 = secret.updated_at ? secret.updated_at.replace("T", " ").slice(0, 16) : null;
+  const details = [
+    secret.host && `sent to ${secret.host}`,
+    when2 && `entered ${when2}${secret.updated_by ? ` by ${secret.updated_by}` : ""}`,
+    secret.status === "missing" && secret.new_in_version !== null && `new in version ${secret.new_in_version}`,
+    secret.status === "unused" && "no longer declared by the app; remove it when you are sure"
+  ].filter(Boolean);
+  return `  ${secret.name.padEnd(width)}  ${secret.status.padEnd(7)}  ${details.join(", ")}`.trimEnd();
+}
+async function secretList(root, options, out2) {
+  const print = options.print ?? ((text) => console.log(text));
+  const only = envOption(options.appEnv);
+  if (only === null) {
+    out2.error('--env must be "live" or "preview"');
+    return 1;
+  }
+  const found = await target2(root, options, out2);
+  if (!found) return 1;
+  try {
+    const envs = only ? [only] : ENVS2;
+    const results = await Promise.all(envs.map((env) => fetchSecrets(found.api, found.appPath, env)));
+    if (results.some((result) => !result)) {
+      out2.error("The API did not return the secrets.");
+      return 1;
+    }
+    const byEnv = Object.fromEntries(envs.map((env, index) => [env, results[index]]));
+    if (options.json) {
+      print(JSON.stringify(byEnv, null, 2));
+      return 0;
+    }
+    const known = new Set(results.flatMap((result) => result.secrets.map((secret) => secret.name)));
+    const width = Math.max(4, ...[...known].map((name) => name.length));
+    for (const env of envs) {
+      const { secrets, blocked_version: blocked } = byEnv[env];
+      out2.info(`${env}${blocked !== null ? `  (version ${blocked} is waiting for the missing values)` : ""}`);
+      if (secrets.length === 0) out2.info("  none");
+      for (const secret of secrets) out2.info(describeSecret(secret, width));
+    }
+    const local = found.project.manifest.secrets.map((secret) => secret.name).filter((name) => !known.has(name));
+    if (local.length > 0) {
+      out2.info("");
+      out2.info(`In ${MANIFEST_FILE} but not deployed yet: ${local.join(", ")}. You can enter their values now, or after \`oneteam-apps deploy\`.`);
+    }
+    const missing = { preview: [], live: [] };
+    for (const env of envs) missing[env] = byEnv[env].secrets.filter((secret) => secret.status === "missing").map((secret) => secret.name);
+    for (const line of describeMissingSecrets(missing)) out2.info(line);
+    return 0;
+  } catch (error) {
+    out2.error(error.message);
+    return 1;
+  }
+}
+async function secretSet(root, name, options, out2) {
+  const problem = nameProblem(name, "set");
+  if (problem) {
+    out2.error(problem);
+    return 1;
+  }
+  const env = envOption(options.appEnv);
+  if (!env) {
+    out2.error(env === null ? '--env must be "live" or "preview"' : ENV_REQUIRED);
+    return 1;
+  }
+  const found = await target2(root, options, out2);
+  if (!found) return 1;
+  if (!found.project.manifest.secrets.some((secret) => secret.name === name)) {
+    out2.error(
+      `${name} is not listed under "secrets" in ${MANIFEST_FILE}. Add { "name": "${name}" } there first (a typo here would save a value the app never reads).`
+    );
+    return 1;
+  }
+  let value;
+  try {
+    value = await readSecretValue(`Value for ${name} (${env}), hidden: `, options.input ?? { stdin: process.stdin, stderr: process.stderr });
+  } catch (error) {
+    out2.error(error.message);
+    return 1;
+  }
+  if (value.trim().length === 0) {
+    out2.error("No value given. Nothing was saved.");
+    return 1;
+  }
+  try {
+    await found.api.put(`${found.appPath}/secrets/${encodeURIComponent(name)}?env=${env}`, { value });
+  } catch (error) {
+    out2.error(`Could not save ${name}: ${error.message.split(value).join("[value]")}`);
+    return 1;
+  }
+  const other = env === "live" ? "preview" : "live";
+  const missing = await missingSecrets(found.api, found.appPath);
+  if (options.json) {
+    (options.print ?? ((text) => console.log(text)))(JSON.stringify({ saved: true, name, env, missing }, null, 2));
+    return 0;
+  }
+  out2.info(`Saved ${name} for ${env}. Nobody can read it back; to change it, set it again.`);
+  if (missing?.[other].includes(name)) {
+    out2.info(`${other} has no value for ${name} yet. It is entered separately: oneteam-apps secret set ${name} --env ${other}`);
+  }
+  const rest = missing && { preview: missing.preview.filter((item) => item !== name), live: missing.live.filter((item) => item !== name) };
+  if (rest && rest.preview.length + rest.live.length > 0) {
+    out2.info(`Still without a value: ${ENVS2.flatMap((item) => rest[item].map((secret) => `${secret} (${item})`)).join(", ")}`);
+  }
+  return 0;
+}
+async function secretRemove(root, name, options, out2) {
+  const problem = nameProblem(name, "remove");
+  if (problem) {
+    out2.error(problem);
+    return 1;
+  }
+  const env = envOption(options.appEnv);
+  if (!env) {
+    out2.error(env === null ? '--env must be "live" or "preview"' : ENV_REQUIRED);
+    return 1;
+  }
+  const found = await target2(root, options, out2);
+  if (!found) return 1;
+  try {
+    await found.api.delete(`${found.appPath}/secrets/${encodeURIComponent(name)}?env=${env}`);
+  } catch (error) {
+    out2.error(`Could not remove ${name}: ${error.message}`);
+    return 1;
+  }
+  if (options.json) {
+    (options.print ?? ((text) => console.log(text)))(JSON.stringify({ removed: true, name, env }, null, 2));
+    return 0;
+  }
+  out2.info(`Removed the ${env} value of ${name}.`);
+  if (found.project.manifest.secrets.some((secret) => secret.name === name)) {
+    out2.warn(`${name} is still listed in ${MANIFEST_FILE}: the app needs a value for it in ${env}.`);
+  }
+  return 0;
+}
+var USAGE2 = "Usage: oneteam-apps secret list|set|remove [NAME] --env live|preview";
+async function secretCommand(root, args, base, out2, quiet2 = out2) {
+  const [action, ...rest] = args;
+  if (rest.some((arg) => /^--?(?:value|secret|val)(?:=|$)/i.test(arg))) {
+    out2.error(
+      "A secret's value is never passed on the command line. Run `oneteam-apps secret set NAME --env live|preview` and type it at the hidden prompt, or pipe it in."
+    );
+    return 1;
+  }
+  let parsed;
+  try {
+    parsed = parseArgs2({
+      args: rest,
+      allowPositionals: true,
+      options: { api: { type: "string" }, organisation: { type: "string" }, json: { type: "boolean" }, env: { type: "string" } }
+    });
+  } catch {
+    out2.error(`Unknown option. ${USAGE2}`);
+    return 1;
+  }
+  const { values, positionals } = parsed;
+  const options = { ...base, api: values.api, organisation: values.organisation, json: values.json, appEnv: values.env };
+  const output = values.json ? quiet2 : out2;
+  if (action === void 0 || action === "list") {
+    if (positionals.length > 0) {
+      out2.error(USAGE2);
+      return 1;
+    }
+    return secretList(root, options, output);
+  }
+  if (action === "set" || action === "remove") {
+    if (positionals.length > 1) {
+      out2.error(
+        action === "set" ? "Only the name goes on the command line, never the value: `oneteam-apps secret set NAME --env live|preview`, then type the value at the hidden prompt." : "One name at a time: oneteam-apps secret remove NAME --env live|preview"
+      );
+      return 1;
+    }
+    return action === "set" ? secretSet(root, positionals[0], options, output) : secretRemove(root, positionals[0], options, output);
+  }
+  out2.error(USAGE2);
+  return 1;
+}
+
+// src/hosted/deploy.ts
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+function indent(text, by) {
+  return text.split("\n").join(`
+${by}`);
+}
+function formatReview(version) {
+  const lines = [];
+  const review = version.review;
+  if (!review) return lines;
+  if (review.checks.length > 0) {
+    lines.push("", "Checks");
+    for (const check of review.checks) {
+      lines.push(`  ${check.passed ? "PASS" : "FAIL"}  ${check.title}${check.detail ? ` (${check.detail})` : ""}`);
+    }
+  }
+  const open = review.findings.filter((finding) => !finding.resolved);
+  if (open.length > 0) {
+    lines.push("", "Findings");
+    for (const finding of open) {
+      const where = finding.file ? `${finding.file}${finding.line ? `:${finding.line}` : ""}` : "(whole app)";
+      lines.push(`  ${finding.severity.toUpperCase().padEnd(6)}  ${where}`);
+      lines.push(`          ${finding.title}`);
+      if (finding.detail) lines.push(`          ${indent(finding.detail, "          ")}`);
+      if (finding.fix) lines.push(`          Fix: ${indent(finding.fix, "          ")}`);
+    }
+  }
+  const data = review.data_summary;
+  const rows = data ? [
+    ["Stores", data.stores],
+    ["Personal data", data.personal_data],
+    ["Reads", data.reads],
+    ["Changes", data.changes],
+    ["Sends outside", data.sends_outside]
+  ].filter(([, values]) => values.length > 0) : [];
+  if (rows.length > 0) {
+    lines.push("", "What the review understood about the data");
+    for (const [label, values] of rows) lines.push(`  ${`${label}:`.padEnd(15)}${values.join("; ")}`);
+  }
+  return lines;
+}
+function manifestForUpload(raw, manifest2) {
+  const suggested = manifest2.suggested_audience;
+  const audience = suggested && (suggested.network_ids.length > 0 || suggested.function_ids.length > 0) ? { network_ids: suggested.network_ids, function_ids: suggested.function_ids } : void 0;
+  return JSON.stringify({ ...raw, ...audience && { audience } });
+}
+async function waitForReview(api, appPath, version, options, out2) {
+  if (version.status !== "reviewing") return { version, app: null };
+  out2.info("Review in progress\u2026");
+  const deadline = Date.now() + (options.reviewTimeoutMs ?? 5 * 6e4);
+  while (Date.now() < deadline) {
+    await sleep(options.pollMs ?? 3e3);
+    const app = parseHostedApp(await api.get(appPath));
+    if (!app) continue;
+    const reviewed = [app.latest_version, app.preview_version, app.live_version].find((candidate) => candidate?.id === version.id);
+    if (reviewed && reviewed.status !== "reviewing") return { version: reviewed, app };
+    if (app.status === "review_failed") {
+      return { version: { ...version, status: "review_failed", review: version.review ?? { passed: false, checks: [], findings: [], data_summary: null } }, app };
+    }
+  }
+  return { version, app: null };
+}
+async function deploy(root, options, out2) {
+  const print = options.print ?? ((text) => console.log(text));
+  const say = options.json ? () => {
+  } : (line) => out2.info(line);
+  const fail = (message, extra = {}) => {
+    if (options.json) print(JSON.stringify({ deployed: false, error: message, ...extra }, null, 2));
+    else out2.error(message);
+    return 1;
+  };
+  const project = readProject(root, options.json ? { ...out2, error: () => {
+  } } : out2);
+  if (!project) return options.json ? fail(`${MANIFEST_FILE} is missing or invalid. Run \`oneteam-apps validate\`.`) : 1;
+  const api = await connect(options, options.json ? { ...out2, error: () => {
+  } } : out2);
+  if (!api) return options.json ? fail("Not signed in. Run `oneteam-apps login`, or set ONETEAM_TOKEN.") : 1;
+  const organisationId = organisationFor(options, project.manifest, api.apiUrl);
+  if (!organisationId) return fail(NO_ORGANISATION);
+  const jobs = checkJobsAndSends(root, project.manifest);
+  if (jobs.errors.length > 0) return fail(jobs.errors.join("\n"), { problems: jobs.errors });
+  if (!options.json) for (const warning of jobs.warnings) out2.warn(warning);
+  let bundle;
+  try {
+    bundle = await createBundle(root, { ...options, log: say });
+  } catch (error) {
+    return fail(error.message);
+  }
+  const design = findUiWarnings(root).length;
+  if (design > 0 && !options.json) {
+    out2.warn(`${design} place(s) in src/client use a written-out colour or a hand-made button, input or dialog. Not a blocker; \`oneteam-apps doctor\` lists them.`);
+  }
+  say(
+    `Packed ${bundle.files.assets} asset file(s), ${bundle.files.migrations} migration(s) and ${bundle.files.source} source file(s) (${(bundle.archive.length / 1024).toFixed(0)} KB).`
+  );
+  let { manifest: manifest2, raw } = project;
+  const summary = options.summary ?? manifest2.summary;
+  if (options.summary) raw = { ...raw, summary: options.summary };
+  try {
+    if (!manifest2.id) {
+      const registered = await api.post(`/v1/organisations/${encodeURIComponent(organisationId)}/apps`, {
+        hosting: "hosted",
+        name: manifest2.name,
+        slug: manifest2.slug,
+        ...manifest2.description && { description: manifest2.description },
+        // What the gateway asks for at sign-in, unless the app narrows it down.
+        scopes: manifest2.scopes ?? [...HOSTED_APP_SCOPES],
+        manifest: raw
+      });
+      const appId = registered?.app_id ?? registered?.id;
+      if (appId === void 0 || appId === null) throw new Error("The API registered the app but did not return its id");
+      raw = { ...raw, id: String(appId), organisation_id: organisationId };
+      manifest2 = { ...manifest2, id: String(appId), organisation_id: organisationId };
+      writeFileSync3(join7(root, MANIFEST_FILE), `${JSON.stringify(raw, null, 2)}
+`);
+      say(`Registered "${manifest2.name}" (id ${manifest2.id}); saved the id in ${MANIFEST_FILE}.`);
+    }
+    const appPath = `/v1/organisations/${encodeURIComponent(organisationId)}/apps/${encodeURIComponent(manifest2.id)}`;
+    const form = new FormData();
+    form.set("manifest", manifestForUpload(raw, manifest2));
+    if (summary) form.set("summary", summary);
+    form.set("bundle", new Blob([bundle.archive], { type: "application/gzip" }), "bundle.tar.gz");
+    say("Uploading\u2026");
+    const response = await api.upload(`${appPath}/versions`, form);
+    const uploaded = parseAppVersion(response);
+    if (!uploaded) {
+      return fail("The upload was accepted, but the answer was not a version. Check the result with `oneteam-apps status`.", { response });
+    }
+    const { version, app: polled } = await waitForReview(api, appPath, uploaded, options, options.json ? { ...out2, info: () => {
+    } } : out2);
+    const review = version.review;
+    const label = version.number === null ? "This upload" : `Version ${version.number}`;
+    if (version.status === "reviewing") {
+      if (options.json) print(JSON.stringify({ deployed: false, reviewing: true, app_id: manifest2.id, version }, null, 2));
+      else out2.warn(`${label} of "${manifest2.name}" is still being reviewed. Check again with \`oneteam-apps status\`.`);
+      return 1;
+    }
+    const deployed = review?.passed !== false && (version.status === "preview" || version.status === "live");
+    if (!deployed) {
+      const open = review?.findings.filter((finding) => !finding.resolved) ?? [];
+      const failedChecks = review?.checks.filter((check) => !check.passed) ?? [];
+      if (options.json) {
+        print(JSON.stringify({ deployed: false, app_id: manifest2.id, version }, null, 2));
+      } else {
+        out2.info(`${label} of "${manifest2.name}" did not pass the review.`);
+        for (const line of formatReview(version)) out2.info(line);
+        if (version.rejection_reason) out2.info(`
+Reason: ${version.rejection_reason}`);
+        out2.info("");
+        out2.error(
+          `Deploy stopped: ${open.length > 0 ? `${open.length === 1 ? "1 finding" : `${open.length} findings`} to fix` : failedChecks.length > 0 ? `${failedChecks.length === 1 ? "1 check" : `${failedChecks.length} checks`} failed` : `the version is "${version.status}"`}. Nothing changed for the people using the app. Fix what is listed above and run \`oneteam-apps deploy\` again.`
+        );
+      }
+      return 1;
+    }
+    const app = polled ?? parseHostedApp(await api.get(appPath).catch(() => null));
+    const address = version.status === "live" ? app?.url : app?.preview_url;
+    const missing = manifest2.secrets.length > 0 ? await missingSecrets(api, appPath) : null;
+    const approval = manifest2.schedules.length + manifest2.sends.length > 0 ? needsApproval(manifest2, await fetchSchedules(api, appPath, "live")) : [];
+    if (options.json) {
+      print(
+        JSON.stringify(
+          {
+            deployed: true,
+            app_id: manifest2.id,
+            status: app?.status ?? null,
+            preview_url: app?.preview_url ?? null,
+            url: app?.url ?? null,
+            needs_approval: version.needs_approval,
+            ...missing && { secrets_missing: missing },
+            ...approval.length > 0 && { needs_approval_for: approval },
+            version
+          },
+          null,
+          2
+        )
+      );
+      return 0;
+    }
+    out2.info(`${label} of "${manifest2.name}" passed the review.`);
+    for (const line of formatReview(version)) out2.info(line);
+    out2.info("");
+    out2.info(`${version.status === "live" ? "Live" : "Preview"}: ${address ?? "(run `oneteam-apps status` for the address)"}`);
+    out2.info(
+      version.needs_approval ? "Waiting for approval: an organisation admin has to approve this version in the dashboard before it goes live. Until then only you and invited testers can open the preview." : version.status === "live" ? "This version is live." : "No approval needed for this version."
+    );
+    if (approval.length > 0) {
+      out2.info("");
+      out2.info("An admin has to approve this before it starts:");
+      for (const reason of approval) out2.info(`  ${reason}`);
+      out2.info("  Until then the live app keeps its current jobs and what it may send. Try a job in the preview: oneteam-apps job run NAME --env preview");
+    }
+    if (missing) for (const line of describeMissingSecrets(missing)) out2.info(line);
+    else if (manifest2.secrets.length > 0) {
+      out2.info("");
+      out2.info(`This app declares ${manifest2.secrets.length === 1 ? "a secret" : "secrets"} (${manifest2.secrets.map((secret) => secret.name).join(", ")}). Check that each has a value: oneteam-apps secret list`);
+    }
+    return 0;
+  } catch (error) {
+    return fail(error.message);
+  }
+}
+function describeVersion(label, version) {
+  if (!version) return `${label}: none`;
+  return `${label}: version ${version.number ?? "?"} (${version.status.replace(/_/g, " ")}${version.needs_approval ? ", waiting for approval" : ""})${version.summary ? `: ${version.summary}` : ""}`;
+}
+async function status(root, options, out2) {
+  const print = options.print ?? ((text) => console.log(text));
+  const project = readProject(root, out2);
+  if (!project) return 1;
+  if (!project.manifest.id) {
+    out2.error("This app has not been deployed yet. Run `oneteam-apps deploy`.");
+    return 1;
+  }
+  const api = await connect(options, out2);
+  if (!api) return 1;
+  const organisationId = organisationFor(options, project.manifest, api.apiUrl);
+  if (!organisationId) {
+    out2.error(NO_ORGANISATION);
+    return 1;
+  }
+  try {
+    const app = parseHostedApp(
+      await api.get(`/v1/organisations/${encodeURIComponent(organisationId)}/apps/${encodeURIComponent(project.manifest.id)}`)
+    );
+    if (!app) {
+      out2.error("The API did not return the app.");
+      return 1;
+    }
+    const missing = await missingSecrets(api, `/v1/organisations/${encodeURIComponent(organisationId)}/apps/${encodeURIComponent(project.manifest.id)}`);
+    if (options.json) {
+      print(JSON.stringify({ ...app, ...missing && { secrets_missing: missing } }, null, 2));
+      return 0;
+    }
+    out2.info(`${app.name}: ${app.status.replace(/_/g, " ")}`);
+    out2.info(`Live address:    ${app.url ?? "none"}`);
+    out2.info(`Preview address: ${app.preview_url ?? "none"}`);
+    out2.info(describeVersion("Live", app.live_version));
+    out2.info(describeVersion("Preview", app.preview_version));
+    const latest = app.latest_version;
+    if (latest && latest.id !== app.preview_version?.id && latest.id !== app.live_version?.id) {
+      out2.info(`Latest upload: ${latest.status.replace(/_/g, " ")}${latest.rejection_reason ? ` (${latest.rejection_reason})` : ""}`);
+      if (latest.review && !latest.review.passed) for (const line of formatReview(latest)) out2.info(line);
+    }
+    if (missing) for (const line of describeMissingSecrets(missing)) out2.info(line);
+    const appPath = `/v1/organisations/${encodeURIComponent(organisationId)}/apps/${encodeURIComponent(project.manifest.id)}`;
+    const live = await fetchSchedules(api, appPath, "live");
+    const lines = live ? describeSchedules("live", live) : [];
+    if (lines.length > 0) {
+      out2.info("");
+      for (const line of lines) out2.info(line);
+    }
+    if (app.preview_version && project.manifest.schedules.length + project.manifest.sends.length > 0) {
+      const approval = needsApproval(project.manifest, live);
+      if (approval.length > 0) {
+        out2.info("");
+        out2.info(`Waiting for an admin's approval before it starts: ${approval.join("; ")}`);
+      }
+    }
+    return 0;
+  } catch (error) {
+    out2.error(error.message);
+    return 1;
+  }
+}
+function formatEvent(event) {
+  const time = event.created_at ? event.created_at.replace("T", " ").slice(0, 19) : "";
+  const head = `${time}  ${event.env.padEnd(7)}  ${String(event.status ?? "").padEnd(3)}  ${(event.method ?? "").padEnd(6)} ${event.path ?? ""}`;
+  if (event.type !== "error") return `${head}  ${event.duration_ms ?? 0}ms`;
+  return [head, ...event.message ? [`    ${indent(event.message, "    ")}`] : [], ...event.stack ? [`    ${indent(event.stack, "    ")}`] : []].join("\n");
+}
+async function logs(root, options, out2) {
+  const print = options.print ?? ((text) => console.log(text));
+  const project = readProject(root, out2);
+  if (!project) return 1;
+  if (!project.manifest.id) {
+    out2.error("This app has not been deployed yet. Run `oneteam-apps deploy`.");
+    return 1;
+  }
+  if (options.appEnv && options.appEnv !== "live" && options.appEnv !== "preview") {
+    out2.error('--env must be "live" or "preview"');
+    return 1;
+  }
+  const hours = Number(options.hours ?? 24);
+  if (!Number.isFinite(hours) || hours <= 0) {
+    out2.error("--hours must be a positive number");
+    return 1;
+  }
+  const api = await connect(options, out2);
+  if (!api) return 1;
+  const organisationId = organisationFor(options, project.manifest, api.apiUrl);
+  if (!organisationId) {
+    out2.error(NO_ORGANISATION);
+    return 1;
+  }
+  try {
+    const query = new URLSearchParams({ ...options.appEnv && { env: options.appEnv }, hours: String(hours) });
+    const result = await api.get(
+      `/v1/organisations/${encodeURIComponent(organisationId)}/apps/${encodeURIComponent(project.manifest.id)}/logs?${query}`
+    );
+    const errors = result?.errors ?? [];
+    const requests = result?.requests ?? [];
+    if (options.json) {
+      print(JSON.stringify({ errors, requests }, null, 2));
+      return 0;
+    }
+    out2.info(`Last ${hours} hour(s)${options.appEnv ? `, ${options.appEnv}` : ""}: ${errors.length} error(s), ${requests.length} request(s)`);
+    if (errors.length > 0) {
+      out2.info("");
+      out2.info("Errors");
+      for (const event of errors) out2.info(formatEvent(event));
+    }
+    if (requests.length > 0) {
+      out2.info("");
+      out2.info("Requests");
+      for (const event of requests.slice(0, 100)) out2.info(formatEvent(event));
+      if (requests.length > 100) out2.info(`\u2026 and ${requests.length - 100} more (use --json for all of them)`);
+    }
+    return 0;
+  } catch (error) {
+    out2.error(error.message);
+    return 1;
+  }
+}
+
+// src/hosted/init.ts
+import { cpSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync7, renameSync, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname3, join as join8, relative as relative3, resolve } from "path";
+import { fileURLToPath } from "url";
+import { APP_SLUG } from "@oneteam-app/apps/contracts";
+function templateDirectory() {
+  const here = dirname3(fileURLToPath(import.meta.url));
+  const found = [join8(here, "..", "templates", "hosted"), join8(here, "..", "..", "templates", "hosted")].find(
+    (candidate) => existsSync7(join8(candidate, "package.json"))
+  );
+  if (!found) throw new Error("The hosted template is missing from this installation of the CLI");
+  return found;
+}
+function slugify(name) {
+  return name.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "");
+}
+function cliVersion() {
+  return true ? "0.1.0-alpha.7" : "0.0.0";
+}
+function replaceIn(path, edit) {
+  writeFileSync4(path, edit(readFileSync7(path, "utf8")));
+}
+function initHosted(root, name, options, out2) {
+  const slug = slugify(name);
+  if (slug.length < 2 || !APP_SLUG.test(slug)) {
+    out2.error(`"${name}" does not make a usable address. Use a name with at least two letters or digits.`);
+    return 1;
+  }
+  const target3 = resolve(root, options.dir ?? slug);
+  if (existsSync7(target3) && readdirSync4(target3).length > 0 && !options.force) {
+    out2.error(`${relative3(root, target3) || "."} already exists and is not empty. Pick another name, pass --dir, or use --force.`);
+    return 1;
+  }
+  mkdirSync3(target3, { recursive: true });
+  cpSync(templateDirectory(), target3, { recursive: true });
+  if (existsSync7(join8(target3, "_gitignore"))) renameSync(join8(target3, "_gitignore"), join8(target3, ".gitignore"));
+  const version = `^${cliVersion()}`;
+  replaceIn(join8(target3, "package.json"), (contents) => {
+    const pkg = JSON.parse(contents);
+    pkg.name = slug;
+    pkg.dependencies["@oneteam-app/apps"] = options.sdkVersion ?? version;
+    pkg.dependencies["@oneteam-app/ui"] = options.uiVersion ?? version;
+    pkg.devDependencies["@oneteam-app/apps-cli"] = options.cliVersion ?? version;
+    return `${JSON.stringify(pkg, null, 2)}
+`;
+  });
+  replaceIn(join8(target3, MANIFEST_FILE), (contents) => {
+    const manifest2 = JSON.parse(contents);
+    return `${JSON.stringify(
+      {
+        ...manifest2,
+        name,
+        slug,
+        description: "",
+        summary: "First version.",
+        // What the template stores; update it when the app stores something else.
+        personal_data: manifest2.personal_data,
+        suggested_audience: { description: "" }
+      },
+      null,
+      2
+    )}
+`;
+  });
+  replaceIn(
+    join8(target3, "wrangler.jsonc"),
+    (contents) => contents.replace('"name": "lost-and-found"', `"name": "${slug}"`).replace('"database_name": "lost-and-found"', `"database_name": "${slug}"`)
+  );
+  replaceIn(join8(target3, "README.md"), (contents) => contents.replace("# Lost and found (hosted app template)", `# ${name}`));
+  out2.info(`created ${relative3(root, target3) || "."} from the hosted template`);
+  writeAgentSection(target3, HOSTED_AGENT_INSTRUCTIONS, out2);
+  const cursorRule = join8(target3, ".cursor", "rules", "oneteam-apps.mdc");
+  mkdirSync3(dirname3(cursorRule), { recursive: true });
+  writeFileSync4(cursorRule, HOSTED_CURSOR_RULE);
+  out2.info("created .cursor/rules/oneteam-apps.mdc");
+  out2.info("");
+  out2.info("Next steps:");
+  out2.info(`  1. cd ${relative3(root, target3) || "."} && npm install`);
+  out2.info('  2. npm run dev      the app with a "View as" bar instead of sign-on, no network needed');
+  out2.info("  3. Replace the example feature (a lost and found log) with yours; keep the permission tests passing: npm test");
+  out2.info("  4. npx oneteam-apps login && npx oneteam-apps deploy --organisation <id>");
+  return 0;
+}
 
 // src/index.ts
-var HELP = `oneteam-apps: Oneteam login for your app
+var HELP = `oneteam-apps: build apps for Oneteam
 
-Usage
+Hosted apps (the platform runs the app and signs people in)
+  oneteam-apps init --hosted <name> [--dir <folder>] [--force]
+  oneteam-apps login [--organisation <id>] [--no-browser]
+  oneteam-apps deploy [--organisation <id>] [--summary <what changed>] [--json]
+  oneteam-apps status [--json]
+  oneteam-apps logs [--env live|preview] [--hours <n>] [--json]
+  oneteam-apps job list [--env live|preview] [--json]
+  oneteam-apps job run <NAME> --env live|preview
+  oneteam-apps secret list [--env live|preview] [--json]
+  oneteam-apps secret set <NAME> --env live|preview
+  oneteam-apps secret remove <NAME> --env live|preview
+
+Apps you host yourself (adds Oneteam login to a Next.js or TanStack Start app)
   oneteam-apps init [--name <app name>] [--url <production url>] [--force]
+
+Both
   oneteam-apps validate [file]
   oneteam-apps doctor [--offline]
 
 Commands
-  init      Add Oneteam login to a Next.js App Router project (non-interactive)
+  init      Start a hosted app from the template, or add Oneteam login to an existing app
+  login     Sign in to deploy. Not needed when ONETEAM_TOKEN is set (a personal access token)
+  deploy    Build, upload and review the app. Prints what to fix, or the preview address.
+            Exit code 0: deployed. 1: stopped
+  status    Where the app stands: status, addresses, live and preview version
+  logs      Recent errors and requests of the running app
+  job       Scheduled jobs ("schedules" in oneteam.app.json): what runs when, how the
+            last run went, and running one now. A job run by hand does everything it
+            does on its schedule, sending included
+  secret    Values the app needs but must not contain (an API key for another service).
+            The app names them under "secrets" in oneteam.app.json; a person enters each
+            value once per environment. \`set\` asks for it at a hidden prompt, or reads
+            stdin when piped. There is no --value flag, and no way to read a value back
   validate  Check oneteam.app.json against the manifest schema
-  doctor    Check manifest, environment, route protection and connectivity
+  doctor    Check the project's setup
+
+Environment
+  ONETEAM_TOKEN            Token for the API, instead of \`login\`
+  ONETEAM_ORGANISATION_ID  The organisation to register a new app in
+  ONETEAM_API_URL          Defaults to https://api.oneteam.io
 `;
 var out = {
   info: (message) => console.log(message),
   warn: (message) => console.warn(`warning: ${message}`),
   error: (message) => console.error(`error: ${message}`)
 };
+var quiet = { ...out, info: (message) => console.error(message) };
+var shared = {
+  api: { type: "string" },
+  organisation: { type: "string" },
+  json: { type: "boolean" }
+};
 async function main(argv) {
   const [command, ...rest] = argv;
   const root = process.cwd();
-  if (!command || command === "--help" || command === "-h") {
+  const env = process.env;
+  if (!command || command === "--help" || command === "-h" || command === "help") {
     console.log(HELP);
     return command ? 0 : 1;
   }
   if (command === "init") {
-    const { values } = parseArgs({
+    const { values, positionals } = parseArgs3({
       args: rest,
-      options: { name: { type: "string" }, url: { type: "string" }, force: { type: "boolean" } }
+      allowPositionals: true,
+      options: {
+        name: { type: "string" },
+        url: { type: "string" },
+        force: { type: "boolean" },
+        // With a value: the app's name. `--hosted` alone takes the first positional.
+        hosted: { type: "boolean" },
+        dir: { type: "string" },
+        "sdk-version": { type: "string" },
+        "ui-version": { type: "string" },
+        "cli-version": { type: "string" }
+      }
     });
+    if (values.hosted) {
+      const name = positionals.join(" ") || values.name;
+      if (!name) {
+        out.error('Give the app a name: oneteam-apps init --hosted "Lost and found"');
+        return 1;
+      }
+      return initHosted(root, name, { dir: values.dir, force: values.force, sdkVersion: values["sdk-version"], cliVersion: values["cli-version"], uiVersion: values["ui-version"] }, out);
+    }
     return init(root, values, out);
   }
   if (command === "validate") {
-    const { positionals } = parseArgs({ args: rest, allowPositionals: true });
+    const { positionals } = parseArgs3({ args: rest, allowPositionals: true });
     return validate(root, positionals[0], out).code;
   }
   if (command === "doctor") {
-    const { values } = parseArgs({ args: rest, options: { offline: { type: "boolean" } } });
-    return doctor(root, { ...values, env: process.env }, out);
+    const { values } = parseArgs3({ args: rest, options: { offline: { type: "boolean" } } });
+    return doctor(root, { ...values, env }, out);
+  }
+  if (command === "login") {
+    const { values } = parseArgs3({
+      args: rest,
+      options: { api: shared.api, organisation: shared.organisation, "no-browser": { type: "boolean" }, status: { type: "boolean" } }
+    });
+    const apiUrl = apiUrlFrom(env, values.api);
+    if (values.status) {
+      out.info(`${apiUrl}: ${describeAuth(env, apiUrl)}`);
+      return 0;
+    }
+    if (env.ONETEAM_TOKEN) out.warn("ONETEAM_TOKEN is set and takes precedence over what you sign in with here.");
+    return login({ env, apiUrl, organisationId: values.organisation, noBrowser: values["no-browser"] }, out);
+  }
+  if (command === "deploy") {
+    const { values } = parseArgs3({
+      args: rest,
+      options: {
+        ...shared,
+        summary: { type: "string" },
+        worker: { type: "string" },
+        assets: { type: "string" },
+        "skip-build": { type: "boolean" }
+      }
+    });
+    return deploy(root, { ...values, env, skipBuild: values["skip-build"] }, values.json ? quiet : out);
+  }
+  if (command === "status") {
+    const { values } = parseArgs3({ args: rest, options: shared });
+    return status(root, { ...values, env }, values.json ? quiet : out);
+  }
+  if (command === "logs") {
+    const { values } = parseArgs3({ args: rest, options: { ...shared, env: { type: "string" }, hours: { type: "string" } } });
+    return logs(root, { api: values.api, organisation: values.organisation, json: values.json, appEnv: values.env, hours: values.hours, env }, values.json ? quiet : out);
   }
+  if (command === "secret" || command === "secrets") return secretCommand(root, rest, { env }, out, quiet);
+  if (command === "job" || command === "jobs") return jobCommand(root, rest, { env }, out, quiet);
   out.error(`unknown command "${command}"`);
   console.log(HELP);
   return 1;